diff --git a/nix/kubernetes/hosts/worker0/default.nix b/nix/kubernetes/hosts/worker0/default.nix
index 1fac5fae..e7e954f1 100644
--- a/nix/kubernetes/hosts/worker0/default.nix
+++ b/nix/kubernetes/hosts/worker0/default.nix
@@ -102,8 +102,9 @@
     # nix.sshServe.enable = true;
     # nix.sshServe.keys = [ "ssh-dss AAAAB3NzaC1k... bob@example.org" ];
 
-    me.worker_node.enable = true;
+    me.bootstrap.enable = true;
     me.dont_use_substituters.enable = true;
     me.minimal_base.enable = true;
+    me.worker_node.enable = true;
   };
 }
diff --git a/nix/kubernetes/roles/bootstrap/default.nix b/nix/kubernetes/roles/bootstrap/default.nix
index f068c63c..2eda302c 100644
--- a/nix/kubernetes/roles/bootstrap/default.nix
+++ b/nix/kubernetes/roles/bootstrap/default.nix
@@ -17,7 +17,7 @@
     };
 
     bootstrap.manifests = lib.mkOption {
-      type = lib.types.listOf lib.types.path;
+      type = lib.types.listOf lib.types.str;
       default = [ ];
       example = lib.literalExpression ''[ ${./files/clusterrole.yaml} ]'';
       description = "List of kubernetes manifests to load into the cluster.";
@@ -29,8 +29,9 @@
       {
         systemd.services.kube-bootstrap = {
           enable = true;
-          description = "Load initial kubernetes manifests into the cluster.";
+          description = "Load initial kubernetes manifests into the cluster";
           after = [ "kubernetes.target" ];
+          wantedBy = [ "multi-user.target" ];
           path = with pkgs; [
             kubectl
           ];
@@ -40,13 +41,13 @@
           };
           script =
             let
-              manifests = (lib.concatMapStringsSep " " lib.escapeShellArgs config.me.bootstrap.manifests);
+              manifests = (lib.concatMapStringsSep "," lib.escapeShellArg config.me.bootstrap.manifests);
             in
             ''
               set -o pipefail
               IFS=$'\n\t'
 
-              kubectl apply --server-side --force-conflicts -f ${manifests}
+              kubectl --kubeconfig=/.persist/keys/kube/kubelet.kubeconfig apply --server-side --force-conflicts -f ${manifests}
             '';
         };
       };
diff --git a/nix/kubernetes/bootstrap/cilium.yaml b/nix/kubernetes/roles/bootstrap/files/cilium.yaml
similarity index 100%
rename from nix/kubernetes/bootstrap/cilium.yaml
rename to nix/kubernetes/roles/bootstrap/files/cilium.yaml
diff --git a/nix/kubernetes/bootstrap/initial_clusterrole.yaml b/nix/kubernetes/roles/bootstrap/files/initial_clusterrole.yaml
similarity index 100%
rename from nix/kubernetes/bootstrap/initial_clusterrole.yaml
rename to nix/kubernetes/roles/bootstrap/files/initial_clusterrole.yaml
diff --git a/nix/kubernetes/roles/containerd/default.nix b/nix/kubernetes/roles/containerd/default.nix
index e3b61d3a..f7b48ec0 100644
--- a/nix/kubernetes/roles/containerd/default.nix
+++ b/nix/kubernetes/roles/containerd/default.nix
@@ -10,7 +10,7 @@ let
     name = "my-cni-plugins";
     paths = with pkgs; [
       cni-plugins
-      cni-plugin-flannel
+      # cni-plugin-flannel
     ];
   };
   my-cni-configs = pkgs.callPackage ./package/cni_conf/package.nix { };
diff --git a/nix/kubernetes/roles/worker_node/default.nix b/nix/kubernetes/roles/worker_node/default.nix
index 804d6f8f..7a2edc35 100644
--- a/nix/kubernetes/roles/worker_node/default.nix
+++ b/nix/kubernetes/roles/worker_node/default.nix
@@ -18,6 +18,10 @@
   };
 
   config = lib.mkIf config.me.worker_node.enable {
+    me.bootstrap.manifests = [
+      "${../bootstrap/files/initial_clusterrole.yaml}"
+      "${../bootstrap/files/cilium.yaml}"
+    ];
     me.cilium.enable = true;
     me.containerd.enable = true;
     me.firewall.enable = true;