diff --git a/roles/kubernetes/kubeadm/handler/main.yml b/roles/kubernetes/kubeadm/handler/main.yml
new file mode 100644
index 000000000..216090070
--- /dev/null
+++ b/roles/kubernetes/kubeadm/handler/main.yml
@@ -0,0 +1,5 @@
+---
+- name: restart kubelet
+  service:
+    name: kubelet
+    state: restarted
diff --git a/roles/kubernetes/kubeadm/tasks/main.yml b/roles/kubernetes/kubeadm/tasks/main.yml
index ad902b4f0..14a577106 100644
--- a/roles/kubernetes/kubeadm/tasks/main.yml
+++ b/roles/kubernetes/kubeadm/tasks/main.yml
@@ -38,10 +38,11 @@
 - name: Update server field in kubelet kubeconfig
   replace:
     path: "{{ kube_config_dir }}/kubelet.conf"
-    regexp: '(\s+){{ first_kube_master }}:{{ kube_apiserver_port }}(\s+.*)?$'
+    regexp: '(\s+)https://{{ first_kube_master }}:{{ kube_apiserver_port }}(\s+.*)?$'
     replace: '\1{{ kube_apiserver_endpoint }}\2'
     backup: yes
   when: not is_kube_master and kubeadm_discovery_address != kube_apiserver_endpoint
+  notify: restart kubelet
 
 # FIXME(mattymo): Reconcile kubelet kubeconfig filename for both deploy modes
 - name: Symlink kubelet kubeconfig for calico/canal
diff --git a/scale.yml b/scale.yml
index 6a6096bb1..0bd7e7d23 100644
--- a/scale.yml
+++ b/scale.yml
@@ -27,7 +27,9 @@
     - role: rkt
       tags: rkt
       when: "'rkt' in [etcd_deployment_type, kubelet_deployment_type, vault_deployment_type]"
+    - { role: download, tags: download, skip_downloads: false }
     - { role: etcd, tags: etcd, etcd_cluster_setup: false }
     - { role: vault, tags: vault, when: "cert_management == 'vault'"}
     - { role: kubernetes/node, tags: node }
+    - { role: kubernetes/kubeadm, tags: kubeadm, when: "kubeadm_enabled" }
     - { role: network_plugin, tags: network }