diff --git a/pkg/scripts/kubeadm_test.go b/pkg/scripts/kubeadm_test.go
index 088d275fd..b7a058981 100644
--- a/pkg/scripts/kubeadm_test.go
+++ b/pkg/scripts/kubeadm_test.go
@@ -261,7 +261,7 @@ func TestKubeadmUpgradeLeader(t *testing.T) {
 			name: "v1beta2",
 			args: args{
 				workdir:    "test-wd",
-				kubeadmCmd: "kubeadm upgrade node",
+				kubeadmCmd: "kubeadm upgrade node --certificate-renewal=true",
 			},
 		},
 	}
diff --git a/pkg/scripts/testdata/TestKubeadmUpgradeLeader-v1beta2.golden b/pkg/scripts/testdata/TestKubeadmUpgradeLeader-v1beta2.golden
index d733fe824..dbe612327 100644
--- a/pkg/scripts/testdata/TestKubeadmUpgradeLeader-v1beta2.golden
+++ b/pkg/scripts/testdata/TestKubeadmUpgradeLeader-v1beta2.golden
@@ -1,4 +1,4 @@
 set -xeu pipefail
 export "PATH=$PATH:/sbin:/usr/local/bin:/opt/bin"
 
-sudo kubeadm upgrade node --config=test-wd/cfg/master_0.yaml
\ No newline at end of file
+sudo kubeadm upgrade node --certificate-renewal=true --config=test-wd/cfg/master_0.yaml
\ No newline at end of file
diff --git a/pkg/templates/kubeadm/kubeadm.go b/pkg/templates/kubeadm/kubeadm.go
index 00fff1543..4ac1acd0b 100644
--- a/pkg/templates/kubeadm/kubeadm.go
+++ b/pkg/templates/kubeadm/kubeadm.go
@@ -25,7 +25,7 @@ import (
 )
 
 const (
-	kubeadmUpgradeNodeCommand = "kubeadm upgrade node"
+	kubeadmUpgradeNodeCommand = "kubeadm upgrade node --certificate-renewal=true"
 )
 
 var (
diff --git a/pkg/templates/kubeadm/kubeadmv1beta2.go b/pkg/templates/kubeadm/kubeadmv1beta2.go
index 1534bf321..293d1c966 100644
--- a/pkg/templates/kubeadm/kubeadmv1beta2.go
+++ b/pkg/templates/kubeadm/kubeadmv1beta2.go
@@ -48,7 +48,7 @@ func (*kubeadmv1beta2) ConfigWorker(s *state.State, instance kubeoneapi.HostConf
 }
 
 func (k *kubeadmv1beta2) UpgradeLeaderCommand() string {
-	return fmt.Sprintf("kubeadm upgrade apply -y %s", k.version)
+	return fmt.Sprintf("kubeadm upgrade apply -y --certificate-renewal=true %s", k.version)
 }
 
 func (*kubeadmv1beta2) UpgradeFollowerCommand() string {