diff --git a/roles/kubernetes/master/tasks/kubeadm-secondary-experimental.yml b/roles/kubernetes/master/tasks/kubeadm-secondary-experimental.yml
index 073f8b6f5..def03249e 100644
--- a/roles/kubernetes/master/tasks/kubeadm-secondary-experimental.yml
+++ b/roles/kubernetes/master/tasks/kubeadm-secondary-experimental.yml
@@ -30,8 +30,10 @@
 - name: Parse certificate key if not set
   set_fact:
     kubeadm_certificate_key: "{{ hostvars[groups['kube-master'][0]]['kubeadm_upload_cert'].stdout_lines[-1] | trim }}"
-  when: kubeadm_certificate_key is undefined
-
+  run_once: yes
+  when:
+    - hostvars[groups['kube-master'][0]]['kubeadm_upload_cert'] is defined
+    - hostvars[groups['kube-master'][0]]['kubeadm_upload_cert'] is not skipped
 
 - name: Create kubeadm ControlPlane config
   template: