diff --git a/pkg/model/bootstrapscript.go b/pkg/model/bootstrapscript.go
index 1dc83a442c..2945179d29 100644
--- a/pkg/model/bootstrapscript.go
+++ b/pkg/model/bootstrapscript.go
@@ -78,13 +78,13 @@ var (
 )
 
 // kubeEnv returns the boot config for the instance group
-func (b *BootstrapScript) kubeEnv(ig *kops.InstanceGroup, c *fi.Context) (string, error) {
+func (b *BootstrapScript) kubeEnv(ig *kops.InstanceGroup, c *fi.Context) (*nodeup.BootConfig, error) {
 	var alternateNames []string
 
 	for _, hasAddress := range b.alternateNameTasks {
 		addresses, err := hasAddress.FindAddresses(c)
 		if err != nil {
-			return "", fmt.Errorf("error finding address for %v: %v", hasAddress, err)
+			return nil, fmt.Errorf("error finding address for %v: %v", hasAddress, err)
 		}
 		if len(addresses) == 0 {
 			// Such tasks won't have an address in dry-run mode, until the resource is created
@@ -104,29 +104,24 @@ func (b *BootstrapScript) kubeEnv(ig *kops.InstanceGroup, c *fi.Context) (string
 		name := *caTask.Name
 		keyset := caTask.Keyset()
 		if keyset == nil {
-			return "", fmt.Errorf("failed to get keyset from %q", name)
+			return nil, fmt.Errorf("failed to get keyset from %q", name)
 		}
 		keysets[name] = keyset
 	}
 	config, bootConfig, err := b.builder.NodeUpConfigBuilder.BuildConfig(ig, alternateNames, keysets)
 	if err != nil {
-		return "", err
+		return nil, err
 	}
 
 	configData, err := utils.YamlMarshal(config)
 	if err != nil {
-		return "", fmt.Errorf("error converting nodeup config to yaml: %v", err)
+		return nil, fmt.Errorf("error converting nodeup config to yaml: %v", err)
 	}
 	sum256 := sha256.Sum256(configData)
 	bootConfig.NodeupConfigHash = base64.StdEncoding.EncodeToString(sum256[:])
 	b.nodeupConfig.Resource = fi.NewBytesResource(configData)
 
-	bootConfigData, err := utils.YamlMarshal(bootConfig)
-	if err != nil {
-		return "", fmt.Errorf("error converting boot config to yaml: %v", err)
-	}
-
-	return string(bootConfigData), nil
+	return bootConfig, nil
 }
 
 func (b *BootstrapScript) buildEnvironmentVariables(cluster *kops.Cluster) (map[string]string, error) {
@@ -338,14 +333,14 @@ func (b *BootstrapScript) Run(c *fi.Context) error {
 		return nil
 	}
 
-	config, err := b.kubeEnv(b.ig, c)
+	bootConfig, err := b.kubeEnv(b.ig, c)
 	if err != nil {
 		return err
 	}
 
 	var nodeupScript resources.NodeUpScript
 	nodeupScript.NodeUpAssets = b.builder.NodeUpAssets
-	nodeupScript.KubeEnv = config
+	nodeupScript.BootConfig = bootConfig
 
 	{
 		nodeupScript.EnvironmentVariables = func() (string, error) {
diff --git a/pkg/model/resources/nodeup.go b/pkg/model/resources/nodeup.go
index 0fa7138c85..38642521ad 100644
--- a/pkg/model/resources/nodeup.go
+++ b/pkg/model/resources/nodeup.go
@@ -28,7 +28,9 @@ import (
 	"text/template"
 
 	"k8s.io/kops/pkg/apis/kops"
+	"k8s.io/kops/pkg/apis/nodeup"
 	"k8s.io/kops/upup/pkg/fi"
+	"k8s.io/kops/upup/pkg/fi/utils"
 	"k8s.io/kops/util/pkg/architectures"
 	"k8s.io/kops/util/pkg/mirrors"
 )
@@ -181,7 +183,7 @@ echo "== nodeup node config done =="
 // NodeUpScript is responsible for creating the nodeup script
 type NodeUpScript struct {
 	NodeUpAssets         map[architectures.Architecture]*mirrors.MirroredAsset
-	KubeEnv              string
+	BootConfig           *nodeup.BootConfig
 	CompressUserData     bool
 	SetSysctls           string
 	CloudProvider        string
@@ -231,8 +233,13 @@ func (b *NodeUpScript) Build() (fi.Resource, error) {
 			return ""
 		},
 
-		"KubeEnv": func() string {
-			return b.KubeEnv
+		"KubeEnv": func() (string, error) {
+			bootConfigData, err := utils.YamlMarshal(b.BootConfig)
+			if err != nil {
+				return "", fmt.Errorf("error converting boot config to yaml: %w", err)
+			}
+
+			return string(bootConfigData), nil
 		},
 
 		"GzipBase64": func(data string) (string, error) {