diff --git a/nodeup/pkg/model/kubelet.go b/nodeup/pkg/model/kubelet.go
index d897f1b5ea..bf6d01788a 100644
--- a/nodeup/pkg/model/kubelet.go
+++ b/nodeup/pkg/model/kubelet.go
@@ -517,6 +517,10 @@ func (b *KubeletBuilder) buildKubeletConfigSpec() (*kops.KubeletConfigSpec, erro
 		c.AuthorizationMode = "Webhook"
 	}
 
+	if c.AuthenticationTokenWebhook == nil && b.Cluster.IsKubernetesGTE("1.19") {
+		c.AuthenticationTokenWebhook = fi.Bool(true)
+	}
+
 	return &c, nil
 }