diff --git a/bootstrap/kubeadm/internal/cloudinit/cloudinit.go b/bootstrap/kubeadm/internal/cloudinit/cloudinit.go
index 3092c051a644..1d31b2f056fb 100644
--- a/bootstrap/kubeadm/internal/cloudinit/cloudinit.go
+++ b/bootstrap/kubeadm/internal/cloudinit/cloudinit.go
@@ -26,7 +26,7 @@ import (
 )
 
 const (
-	standardJoinCommand            = "kubeadm join --config /tmp/kubeadm-join-config.yaml %s"
+	standardJoinCommand            = "kubeadm join --config /run/kubeadm/kubeadm-join-config.yaml %s"
 	retriableJoinScriptName        = "/usr/local/bin/kubeadm-bootstrap-script"
 	retriableJoinScriptOwner       = "root"
 	retriableJoinScriptPermissions = "0755"
diff --git a/bootstrap/kubeadm/internal/cloudinit/controlplane_init.go b/bootstrap/kubeadm/internal/cloudinit/controlplane_init.go
index ce894b72682a..35d4d4a30540 100644
--- a/bootstrap/kubeadm/internal/cloudinit/controlplane_init.go
+++ b/bootstrap/kubeadm/internal/cloudinit/controlplane_init.go
@@ -23,7 +23,7 @@ import (
 const (
 	controlPlaneCloudInit = `{{.Header}}
 {{template "files" .WriteFiles}}
--   path: /tmp/kubeadm.yaml
+-   path: /run/kubeadm/kubeadm.yaml
     owner: root:root
     permissions: '0640'
     content: |
@@ -33,7 +33,7 @@ const (
 {{.InitConfiguration | Indent 6}}
 runcmd:
 {{- template "commands" .PreKubeadmCommands }}
-  - 'kubeadm init --config /tmp/kubeadm.yaml {{.KubeadmVerbosity}}'
+  - 'kubeadm init --config /run/kubeadm/kubeadm.yaml {{.KubeadmVerbosity}}'
 {{- template "commands" .PostKubeadmCommands }}
 {{- template "ntp" .NTP }}
 {{- template "users" .Users }}
diff --git a/bootstrap/kubeadm/internal/cloudinit/controlplane_join.go b/bootstrap/kubeadm/internal/cloudinit/controlplane_join.go
index 9300c05b9dd6..103ba0d903af 100644
--- a/bootstrap/kubeadm/internal/cloudinit/controlplane_join.go
+++ b/bootstrap/kubeadm/internal/cloudinit/controlplane_join.go
@@ -24,7 +24,7 @@ import (
 const (
 	controlPlaneJoinCloudInit = `{{.Header}}
 {{template "files" .WriteFiles}}
--   path: /tmp/kubeadm-join-config.yaml
+-   path: /run/kubeadm/kubeadm-join-config.yaml
     owner: root:root
     permissions: '0640'
     content: |
diff --git a/bootstrap/kubeadm/internal/cloudinit/kubeadm-bootstrap-script.sh b/bootstrap/kubeadm/internal/cloudinit/kubeadm-bootstrap-script.sh
index 22032fb6c890..45cfe79196c5 100644
--- a/bootstrap/kubeadm/internal/cloudinit/kubeadm-bootstrap-script.sh
+++ b/bootstrap/kubeadm/internal/cloudinit/kubeadm-bootstrap-script.sh
@@ -88,7 +88,7 @@ function retry-command() {
   until [ $n -ge 5 ]; do
     log::info "running '$*'"
     # shellcheck disable=SC1083
-    "$@" --config=/tmp/kubeadm-join-config.yaml {{.KubeadmVerbosity}}
+    "$@" --config=/run/kubeadm/kubeadm-join-config.yaml {{.KubeadmVerbosity}}
     kubeadm_return=$?
     check_kubeadm_command "'$*'" "${kubeadm_return}"
     if [ ${kubeadm_return} -eq 0 ]; then
@@ -111,7 +111,7 @@ function try-or-die-command() {
   local kubeadm_return
   log::info "running '$*'"
   # shellcheck disable=SC1083
-  "$@" --config=/tmp/kubeadm-join-config.yaml {{.KubeadmVerbosity}}
+  "$@" --config=/run/kubeadm/kubeadm-join-config.yaml {{.KubeadmVerbosity}}
   kubeadm_return=$?
   check_kubeadm_command "'$*'" "${kubeadm_return}"
   if [ ${kubeadm_return} -ne 0 ]; then
diff --git a/bootstrap/kubeadm/internal/cloudinit/node.go b/bootstrap/kubeadm/internal/cloudinit/node.go
index afe8771b0043..5da4cc8fa41a 100644
--- a/bootstrap/kubeadm/internal/cloudinit/node.go
+++ b/bootstrap/kubeadm/internal/cloudinit/node.go
@@ -19,7 +19,7 @@ package cloudinit
 const (
 	nodeCloudInit = `{{.Header}}
 {{template "files" .WriteFiles}}
--   path: /tmp/kubeadm-join-config.yaml
+-   path: /run/kubeadm/kubeadm-join-config.yaml
     owner: root:root
     permissions: '0640'
     content: |
diff --git a/test/infrastructure/docker/cloudinit/kindadapter_test.go b/test/infrastructure/docker/cloudinit/kindadapter_test.go
index 054d6cd0d91e..809a7e9510bd 100644
--- a/test/infrastructure/docker/cloudinit/kindadapter_test.go
+++ b/test/infrastructure/docker/cloudinit/kindadapter_test.go
@@ -100,7 +100,7 @@ write_files:
         \ 0\nnodeRegistration:\n  criSocket: /var/run/containerd/containerd.sock\n\
         \  kubeletExtraArgs:\n    cloud-provider: aws\n  name: 'ip-10-0-0-223.us-west-2.compute.internal'\n"
     owner: root:root
-    path: /tmp/kubeadm.yaml
+    path: /run/kubeadm/kubeadm.yaml
     permissions: '0640'
 `)
 
@@ -133,10 +133,10 @@ write_files:
 		{Cmd: "mkdir", Args: []string{"-p", "/etc/kubernetes/pki"}},
 		{Cmd: "/bin/sh", Args: []string{"-c", "cat > /etc/kubernetes/pki/sa.key /dev/stdin"}},
 		{Cmd: "chmod", Args: []string{"0600", "/etc/kubernetes/pki/sa.key"}},
-		// /tmp/kubeadm.yaml
+		// /run/kubeadm/kubeadm.yaml
 		{Cmd: "mkdir", Args: []string{"-p", "/tmp"}},
-		{Cmd: "/bin/sh", Args: []string{"-c", "cat > /tmp/kubeadm.yaml /dev/stdin"}},
-		{Cmd: "chmod", Args: []string{"0640", "/tmp/kubeadm.yaml"}},
+		{Cmd: "/bin/sh", Args: []string{"-c", "cat > /run/kubeadm/kubeadm.yaml /dev/stdin"}},
+		{Cmd: "chmod", Args: []string{"0640", "/run/kubeadm/kubeadm.yaml"}},
 	}
 
 	commands, err := Commands(cloudData)
diff --git a/test/infrastructure/docker/cloudinit/runcmd_test.go b/test/infrastructure/docker/cloudinit/runcmd_test.go
index c043ae74d2bc..7d5b4b1de5e4 100644
--- a/test/infrastructure/docker/cloudinit/runcmd_test.go
+++ b/test/infrastructure/docker/cloudinit/runcmd_test.go
@@ -64,11 +64,11 @@ func TestRunCmdRun(t *testing.T) {
 			name: "hack kubeadm ingore errors",
 			r: runCmd{
 				Cmds: []Cmd{
-					{Cmd: "/bin/sh", Args: []string{"-c", "kubeadm init --config /tmp/kubeadm.yaml"}},
+					{Cmd: "/bin/sh", Args: []string{"-c", "kubeadm init --config /run/kubeadm/kubeadm.yaml"}},
 				},
 			},
 			expectedCmds: []Cmd{
-				{Cmd: "/bin/sh", Args: []string{"-c", "kubeadm init --config /tmp/kubeadm.yaml --ignore-preflight-errors=all"}},
+				{Cmd: "/bin/sh", Args: []string{"-c", "kubeadm init --config /run/kubeadm/kubeadm.yaml --ignore-preflight-errors=all"}},
 			},
 		},
 	}
@@ -89,8 +89,8 @@ func TestHackKubeadmIgnoreErrors(t *testing.T) {
 
 	cloudData := `
 runcmd:
-- kubeadm init --config=/tmp/kubeadm.yaml
-- [ kubeadm, join, --config=/tmp/kubeadm-controlplane-join-config.yaml ]`
+- kubeadm init --config=/run/kubeadm/kubeadm.yaml
+- [ kubeadm, join, --config=/run/kubeadm/kubeadm-controlplane-join-config.yaml ]`
 	r := runCmd{}
 	err := r.Unmarshal([]byte(cloudData))
 	g.Expect(err).NotTo(HaveOccurred())
@@ -98,11 +98,11 @@ runcmd:
 
 	r.Cmds[0] = hackKubeadmIgnoreErrors(r.Cmds[0])
 
-	expected0 := Cmd{Cmd: "/bin/sh", Args: []string{"-c", "kubeadm init --config=/tmp/kubeadm.yaml --ignore-preflight-errors=all"}}
+	expected0 := Cmd{Cmd: "/bin/sh", Args: []string{"-c", "kubeadm init --config=/run/kubeadm/kubeadm.yaml --ignore-preflight-errors=all"}}
 	g.Expect(r.Cmds[0]).To(Equal(expected0))
 
 	r.Cmds[1] = hackKubeadmIgnoreErrors(r.Cmds[1])
 
-	expected1 := Cmd{Cmd: "kubeadm", Args: []string{"join", "--config=/tmp/kubeadm-controlplane-join-config.yaml", "--ignore-preflight-errors=all"}}
+	expected1 := Cmd{Cmd: "kubeadm", Args: []string{"join", "--config=/run/kubeadm/kubeadm-controlplane-join-config.yaml", "--ignore-preflight-errors=all"}}
 	g.Expect(r.Cmds[1]).To(Equal(expected1))
 }