diff --git a/bootstrap/cluster/main.tf b/bootstrap/cluster/main.tf
index ac16bc2..f647d7e 100644
--- a/bootstrap/cluster/main.tf
+++ b/bootstrap/cluster/main.tf
@@ -983,17 +983,27 @@ ssh_target='${self.triggers.user}@${self.triggers.host}'
 ssh_key='${self.triggers.ssh_key_path}'
 node_name='${self.triggers.node_name}'
 accept_routes='${self.triggers.worker_tailscale_accept_routes}'
+ssh_host="$${ssh_target#*@}"
+known_hosts_file="$${TF_DATA_DIR:-.terraform}/homelab-worker-known_hosts"
 
-if ! ssh -i "$ssh_key" -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "$ssh_target" \
+mkdir -p "$(dirname "$known_hosts_file")"
+touch "$known_hosts_file"
+chmod 0600 "$known_hosts_file"
+ssh-keygen -R "$ssh_host" -f "$known_hosts_file" >/dev/null 2>&1 || true
+
+worker_ssh() {
+  ssh -i "$ssh_key" -o BatchMode=yes -o ConnectTimeout=10 -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile="$known_hosts_file" "$ssh_target" "$@"
+}
+
+if ! worker_ssh \
   'command -v tailscale >/dev/null 2>&1 && sudo systemctl is-active --quiet tailscaled'; then
   echo "tailscale is not installed or tailscaled is not active on $ssh_target" >&2
   exit 1
 fi
 
-if ssh -i "$ssh_key" -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "$ssh_target" \
+if worker_ssh \
   'test -n "$(tailscale ip -4 2>/dev/null | head -n 1)"'; then
-  ssh -i "$ssh_key" -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "$ssh_target" \
-    "sudo tailscale set --accept-routes=$accept_routes"
+  worker_ssh "sudo tailscale set --accept-routes=$accept_routes"
   exit 0
 fi
 
@@ -1009,11 +1019,10 @@ if [ -z "$auth_key" ]; then
 fi
 
 printf '%s\n' "$auth_key" |
-  ssh -i "$ssh_key" -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "$ssh_target" \
+  worker_ssh \
     "read -r auth_key && sudo tailscale up --auth-key \"\$auth_key\" --hostname '$node_name' --accept-routes=$accept_routes --reset"
 
-ssh -i "$ssh_key" -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "$ssh_target" \
-  'sudo systemctl restart homelab-tailscale-pod-egress.service 2>/dev/null || true'
+worker_ssh 'sudo systemctl restart homelab-tailscale-pod-egress.service 2>/dev/null || true'
 EOT
   }
 
@@ -1025,13 +1034,24 @@ set -euo pipefail
 ssh_target='${self.triggers.user}@${self.triggers.host}'
 ssh_key='${self.triggers.ssh_key_path}'
 node_name='${self.triggers.node_name}'
+ssh_host="$${ssh_target#*@}"
+known_hosts_file="$${TF_DATA_DIR:-.terraform}/homelab-worker-known_hosts"
 
-if ssh -i "$ssh_key" -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "$ssh_target" \
+mkdir -p "$(dirname "$known_hosts_file")"
+touch "$known_hosts_file"
+chmod 0600 "$known_hosts_file"
+ssh-keygen -R "$ssh_host" -f "$known_hosts_file" >/dev/null 2>&1 || true
+
+worker_ssh() {
+  ssh -i "$ssh_key" -o BatchMode=yes -o ConnectTimeout=10 -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile="$known_hosts_file" "$ssh_target" "$@"
+}
+
+if worker_ssh \
   'test -f /etc/kubernetes/kubelet.conf && test -f /var/lib/kubelet/config.yaml'; then
   exit 0
 fi
 
-join_cmd="$(sudo kubeadm token create --print-join-command)"
+join_cmd="$(sudo env KUBECONFIG=/etc/kubernetes/admin.conf kubeadm token create --print-join-command)"
 remote_join_script="$(mktemp)"
 trap 'rm -f "$remote_join_script"' EXIT
 
@@ -1052,8 +1072,7 @@ if [ ! -f /etc/kubernetes/kubelet.conf ] || [ ! -f /var/lib/kubelet/config.yaml
 fi
 JOIN_EOT
 
-ssh -i "$ssh_key" -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "$ssh_target" \
-  'bash -s' <"$remote_join_script"
+worker_ssh 'bash -s' <"$remote_join_script"
 EOT
   }
 }