diff --git a/.gitlab/.gitignore b/.gitlab/.gitignore
index 1afc482f6d..21d2f94b66 100644
--- a/.gitlab/.gitignore
+++ b/.gitlab/.gitignore
@@ -1,5 +1,6 @@
 # Ignore files known to be downloaded by CI jobs.
 /5.15.1-0-202009071110*
+/appimagetool
 /bcc*
 /cmake*
 /emsdk
diff --git a/.gitlab/ci/appimagetool-env.sh b/.gitlab/ci/appimagetool-env.sh
new file mode 100644
index 0000000000..1dd4674880
--- /dev/null
+++ b/.gitlab/ci/appimagetool-env.sh
@@ -0,0 +1,3 @@
+.gitlab/ci/appimagetool.sh
+export PATH=$PWD/.gitlab/appimagetool/bin:$PATH
+appimagetool --version
diff --git a/.gitlab/ci/appimagetool.sh b/.gitlab/ci/appimagetool.sh
new file mode 100755
index 0000000000..6ab430f0d3
--- /dev/null
+++ b/.gitlab/ci/appimagetool.sh
@@ -0,0 +1,32 @@
+#!/bin/sh
+
+set -e
+
+readonly version="1.9.0.20250814"
+
+case "$(uname -s)-$(uname -m)" in
+    Linux-x86_64)
+        shatool="sha256sum"
+        sha256sum="6414d395eafee09453d2e203d9cc65f867e6ff7e1a8a6c08e444d86cb1d106ad"
+        filename="appimagetool-$version-x86_64"
+        ;;
+    *)
+        echo "Unrecognized platform $(uname -s)-$(uname -m)"
+        exit 1
+        ;;
+esac
+readonly shatool
+readonly sha256sum
+
+cd .gitlab
+
+# This URL is only visible inside of Kitware's network.  See above filename table.
+baseurl="https://cmake.org/files/dependencies/internal"
+
+tarball="$filename.tar.gz"
+echo "$sha256sum  $tarball" > appimagetool.sha256sum
+curl -OL "$baseurl/$tarball"
+$shatool --check appimagetool.sha256sum
+tar xzf "$tarball"
+rm "$tarball" appimagetool.sha256sum
+mv "$filename" "appimagetool"
diff --git a/.gitlab/ci/repackage/appimagetool.sh b/.gitlab/ci/repackage/appimagetool.sh
new file mode 100755
index 0000000000..03ce12d24e
--- /dev/null
+++ b/.gitlab/ci/repackage/appimagetool.sh
@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+
+set -e
+
+arch="$1"
+version="${2-1.9.0.20250814}"
+
+dir="appimagetool-$version-$arch"
+mkdir "$dir"
+mkdir -p "$dir/lib/appimagetool"
+
+filename="appimagetool-$arch.AppImage"
+curl -OL "https://github.com/AppImage/appimagetool/releases/download/continuous/$filename"
+chmod +x "$filename"
+"./$filename" --appimage-extract
+mv "squashfs-root/usr/bin" "$dir/bin"
+rm -rf "$filename" "squashfs-root"
+
+filename="runtime-$arch"
+curl -OL "https://github.com/AppImage/type2-runtime/releases/download/continuous/$filename"
+mv "$filename" "$dir/lib/appimagetool/runtime"
+
+cat >"$dir/README.txt" <<EOF
+This was packaged using CMake's ".gitlab/ci/repackage/appimagetool.sh" script.
+EOF
+
+tar czf "$dir.tar.gz" "$dir"
+rm -rf "$dir"