diff --git a/nixos/kubeadm/bootstrap/controller.py b/nixos/kubeadm/bootstrap/controller.py
index f758d42..0c7b393 100755
--- a/nixos/kubeadm/bootstrap/controller.py
+++ b/nixos/kubeadm/bootstrap/controller.py
@@ -316,12 +316,12 @@ class Controller:
             self.log("CNI install already complete")
             return
         self.log("Installing or upgrading Cilium")
-        self.remote(self.primary_ip, "helm repo add cilium https://helm.cilium.io >/dev/null 2>&1 || true")
-        self.remote(self.primary_ip, "helm repo update >/dev/null")
-        self.remote(self.primary_ip, "kubectl create namespace kube-system >/dev/null 2>&1 || true")
+        self.remote(self.primary_ip, "sudo helm repo add cilium https://helm.cilium.io >/dev/null 2>&1 || true")
+        self.remote(self.primary_ip, "sudo helm repo update >/dev/null")
+        self.remote(self.primary_ip, "sudo kubectl --kubeconfig /etc/kubernetes/admin.conf create namespace kube-system >/dev/null 2>&1 || true")
         self.remote(
             self.primary_ip,
-            "helm upgrade --install cilium cilium/cilium --namespace kube-system --set kubeProxyReplacement=true",
+            "sudo KUBECONFIG=/etc/kubernetes/admin.conf helm upgrade --install cilium cilium/cilium --namespace kube-system --set kubeProxyReplacement=true",
         )
         self.mark_done("cni_installed")