diff --git a/bootstrap/cluster/main.tf b/bootstrap/cluster/main.tf
index 4500db0..ce2e96c 100644
--- a/bootstrap/cluster/main.tf
+++ b/bootstrap/cluster/main.tf
@@ -407,6 +407,7 @@ resource "null_resource" "kubeadm_worker" {
     host                                 = each.value.host
     user                                 = each.value.user
     ssh_key_path                         = each.value.ssh_key_path
+    kubeconfig_path                      = var.kubeconfig_path
     registry_endpoint                    = var.registry_endpoint
     registry_config_version              = "8"
     containerd_runtime                   = "docker-containerd-io"
@@ -1035,6 +1036,7 @@ set -euo pipefail
 ssh_target='${self.triggers.user}@${self.triggers.host}'
 ssh_key='${self.triggers.ssh_key_path}'
 node_name='${self.triggers.node_name}'
+kubeconfig_path='${self.triggers.kubeconfig_path}'
 ssh_host="$${ssh_target#*@}"
 known_hosts_file="$${TF_DATA_DIR:-.terraform}/homelab-worker-known_hosts"
 
@@ -1052,7 +1054,21 @@ if worker_ssh \
   exit 0
 fi
 
-join_cmd="$(sudo env KUBECONFIG=/etc/kubernetes/admin.conf kubeadm token create --print-join-command)"
+token_kubeconfig=""
+if [ -s "$kubeconfig_path" ]; then
+  token_kubeconfig="$kubeconfig_path"
+elif [ -s /etc/kubernetes/admin.conf ]; then
+  token_kubeconfig=/etc/kubernetes/admin.conf
+elif [ -n "$${KUBECONFIG:-}" ] && [ -s "$${KUBECONFIG}" ]; then
+  token_kubeconfig="$${KUBECONFIG}"
+fi
+if [ -z "$token_kubeconfig" ]; then
+  echo "No kubeconfig available to create a kubeadm join token." >&2
+  echo "Checked: $kubeconfig_path, /etc/kubernetes/admin.conf, and KUBECONFIG." >&2
+  exit 1
+fi
+
+join_cmd="$(sudo env KUBECONFIG="$token_kubeconfig" kubeadm token create --print-join-command)"
 remote_join_script="$(mktemp)"
 trap 'rm -f "$remote_join_script"' EXIT