diff --git a/nodeup/pkg/model/kubelet.go b/nodeup/pkg/model/kubelet.go
index caad3c40c49c1..09abae92813a8 100644
--- a/nodeup/pkg/model/kubelet.go
+++ b/nodeup/pkg/model/kubelet.go
@@ -566,17 +566,19 @@ func (b *KubeletBuilder) buildKubeletServingCertificate(c *fi.ModelBuilderContex
 			cert, key := b.GetBootstrapCert(name)
 
 			c.AddTask(&nodetasks.File{
-				Path:     filepath.Join(dir, name+".crt"),
-				Contents: cert,
-				Type:     nodetasks.FileType_File,
-				Mode:     fi.String("0644"),
+				Path:           filepath.Join(dir, name+".crt"),
+				Contents:       cert,
+				Type:           nodetasks.FileType_File,
+				Mode:           fi.String("0644"),
+				BeforeServices: []string{"kubelet.service"},
 			})
 
 			c.AddTask(&nodetasks.File{
-				Path:     filepath.Join(dir, name+".key"),
-				Contents: key,
-				Type:     nodetasks.FileType_File,
-				Mode:     fi.String("0400"),
+				Path:           filepath.Join(dir, name+".key"),
+				Contents:       key,
+				Type:           nodetasks.FileType_File,
+				Mode:           fi.String("0400"),
+				BeforeServices: []string{"kubelet.service"},
 			})
 
 		} else {
diff --git a/nodeup/pkg/model/networking/cilium.go b/nodeup/pkg/model/networking/cilium.go
index 8739139dbf2f3..6289b5d4e6a23 100644
--- a/nodeup/pkg/model/networking/cilium.go
+++ b/nodeup/pkg/model/networking/cilium.go
@@ -131,17 +131,19 @@ func (b *CiliumBuilder) buildCiliumEtcdSecrets(c *fi.ModelBuilderContext) error
 		cert, key := b.GetBootstrapCert(name)
 
 		c.AddTask(&nodetasks.File{
-			Path:     filepath.Join(dir, name+".crt"),
-			Contents: cert,
-			Type:     nodetasks.FileType_File,
-			Mode:     fi.String("0644"),
+			Path:           filepath.Join(dir, name+".crt"),
+			Contents:       cert,
+			Type:           nodetasks.FileType_File,
+			Mode:           fi.String("0644"),
+			BeforeServices: []string{"kubelet.service"},
 		})
 
 		c.AddTask(&nodetasks.File{
-			Path:     filepath.Join(dir, name+".key"),
-			Contents: key,
-			Type:     nodetasks.FileType_File,
-			Mode:     fi.String("0400"),
+			Path:           filepath.Join(dir, name+".key"),
+			Contents:       key,
+			Type:           nodetasks.FileType_File,
+			Mode:           fi.String("0400"),
+			BeforeServices: []string{"kubelet.service"},
 		})
 
 		return b.BuildCertificateTask(c, signer, filepath.Join(dir, "etcd-ca.crt"), nil)