diff --git a/images/protokube-builder/onbuild.sh b/images/protokube-builder/onbuild.sh
index 966549dba5..08d1bec0e9 100755
--- a/images/protokube-builder/onbuild.sh
+++ b/images/protokube-builder/onbuild.sh
@@ -32,9 +32,4 @@ cp /src/.build/local/protokube /src/.build/artifacts/
 make channels
 cp /src/.build/local/channels /src/.build/artifacts/
 
-# channels uses protokube
-cd /src/.build/artifacts/
-curl -LO https://storage.googleapis.com/kubernetes-release/release/v1.6.6/bin/linux/amd64/kubectl
-chmod +x kubectl
-
 chown -R $HOST_UID:$HOST_GID /src/.build/artifacts
diff --git a/images/protokube/Dockerfile b/images/protokube/Dockerfile
index a0a6cd8bda..116ccbd105 100644
--- a/images/protokube/Dockerfile
+++ b/images/protokube/Dockerfile
@@ -21,8 +21,6 @@ RUN apt-get update && apt-get install --yes \
   && apt-get clean \
   && rm -rf /var/lib/apt/lists/*
 
-COPY /.build/artifacts/kubectl /usr/bin/kubectl
-
 COPY /.build/artifacts/protokube /usr/bin/protokube
 COPY /.build/artifacts/channels /usr/bin/channels
 
diff --git a/nodeup/pkg/model/context.go b/nodeup/pkg/model/context.go
index 64baec100a..ae5974244b 100644
--- a/nodeup/pkg/model/context.go
+++ b/nodeup/pkg/model/context.go
@@ -246,3 +246,15 @@ func (c *NodeupModelContext) UseSecureKubelet() bool {
 
 	return false
 }
+
+// KubectlPath returns distro based path for kubectl
+func (c *NodeupModelContext) KubectlPath() string {
+	kubeletCommand := "/usr/local/bin"
+	if c.Distribution == distros.DistributionCoreOS {
+		kubeletCommand = "/opt/bin"
+	}
+	if c.Distribution == distros.DistributionContainerOS {
+		kubeletCommand = "/home/kubernetes/bin"
+	}
+	return kubeletCommand
+}
diff --git a/nodeup/pkg/model/kubectl.go b/nodeup/pkg/model/kubectl.go
index 25bc990995..652284e04b 100644
--- a/nodeup/pkg/model/kubectl.go
+++ b/nodeup/pkg/model/kubectl.go
@@ -52,7 +52,7 @@ func (b *KubectlBuilder) Build(c *fi.ModelBuilderContext) error {
 		}
 
 		t := &nodetasks.File{
-			Path:     b.kubectlPath(),
+			Path:     b.KubectlPath() + "/" + assetName,
 			Contents: asset,
 			Type:     nodetasks.FileType_File,
 			Mode:     s("0755"),
@@ -100,14 +100,3 @@ func (b *KubectlBuilder) Build(c *fi.ModelBuilderContext) error {
 
 	return nil
 }
-
-func (b *KubectlBuilder) kubectlPath() string {
-	kubeletCommand := "/usr/local/bin/kubectl"
-	if b.Distribution == distros.DistributionCoreOS {
-		kubeletCommand = "/opt/bin/kubectl"
-	}
-	if b.Distribution == distros.DistributionContainerOS {
-		kubeletCommand = "/home/kubernetes/bin/kubectl"
-	}
-	return kubeletCommand
-}
diff --git a/nodeup/pkg/model/protokube.go b/nodeup/pkg/model/protokube.go
index 2b84166a43..b0c182bd29 100644
--- a/nodeup/pkg/model/protokube.go
+++ b/nodeup/pkg/model/protokube.go
@@ -108,12 +108,27 @@ func (t *ProtokubeBuilder) buildSystemdService() (*nodetasks.Service, error) {
 		"-v", "/:/rootfs/",
 		"-v", "/var/run/dbus:/var/run/dbus",
 		"-v", "/run/systemd:/run/systemd",
-		"--net=host", "--privileged",
+	}
+
+	// add kubectl only if a master
+	// path changes depending on distro, and always mount it on /opt/kops/bin
+	// kubectl is downloaded an installed by other tasks
+	if t.IsMaster {
+		dockerArgs = append(dockerArgs, []string{
+			"-v", t.KubectlPath() + ":/opt/kops/bin:ro",
+			"--env", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/kops/bin",
+		}...)
+	}
+
+	dockerArgs = append(dockerArgs, []string{
+		"--net=host",
+		"--privileged",
 		"--env", "KUBECONFIG=/rootfs/var/lib/kops/kubeconfig",
 		t.ProtokubeEnvironmentVariables(),
 		t.ProtokubeImageName(),
 		"/usr/bin/protokube",
-	}
+	}...)
+
 	protokubeCommand := strings.Join(dockerArgs, " ") + " " + protokubeFlagsArgs
 
 	manifest := &systemd.Manifest{}