diff --git a/metropolis/cli/dbg/main.go b/metropolis/cli/dbg/main.go
index c2c0cb9..0af835a 100644
--- a/metropolis/cli/dbg/main.go
+++ b/metropolis/cli/dbg/main.go
@@ -139,6 +139,9 @@
 			}
 		}
 	case "kubectl":
+		// Pop "kubectl" arg (the k8s cli library internally parses os.Args).
+		os.Args = os.Args[1:]
+
 		// Always get a kubeconfig with cluster-admin (group system:masters),
 		// kubectl itself can impersonate
 		kubeconfigFile, err := os.CreateTemp("", "dbg_kubeconfig")