diff --git a/upup/pkg/fi/cloudup/apply_cluster.go b/upup/pkg/fi/cloudup/apply_cluster.go
index fd25281c8e..3e53723a75 100644
--- a/upup/pkg/fi/cloudup/apply_cluster.go
+++ b/upup/pkg/fi/cloudup/apply_cluster.go
@@ -1155,6 +1155,7 @@ func newNodeUpConfigBuilder(cluster *kops.Cluster, assetBuilder *assets.AssetBui
 
 	for _, role := range kops.AllInstanceGroupRoles {
 		isMaster := role == kops.InstanceGroupRoleMaster
+		isAPIServer := role == kops.InstanceGroupRoleAPIServer
 
 		images[role] = make(map[architectures.Architecture][]*nodeup.Image)
 		if components.IsBaseURL(cluster.Spec.KubernetesVersion) {
@@ -1163,6 +1164,9 @@ func newNodeUpConfigBuilder(cluster *kops.Cluster, assetBuilder *assets.AssetBui
 			if isMaster {
 				components = append(components, "kube-apiserver", "kube-controller-manager", "kube-scheduler")
 			}
+			if isAPIServer {
+				components = append(components, "kube-apiserver")
+			}
 
 			for _, arch := range architectures.GetSupported() {
 				for _, component := range components {
@@ -1212,6 +1216,29 @@ func newNodeUpConfigBuilder(cluster *kops.Cluster, assetBuilder *assets.AssetBui
 				}
 			}
 		}
+		if os.Getenv("KOPS_BASE_URL") != "" && isAPIServer {
+			for _, arch := range architectures.GetSupported() {
+				for _, name := range []string{"kube-apiserver-healthcheck"} {
+					baseURL, err := url.Parse(os.Getenv("KOPS_BASE_URL"))
+					if err != nil {
+						return nil, err
+					}
+
+					baseURL.Path = path.Join(baseURL.Path, "/images/"+name+"-"+string(arch)+".tar.gz")
+
+					u, hash, err := assetBuilder.RemapFileAndSHA(baseURL)
+					if err != nil {
+						return nil, err
+					}
+
+					image := &nodeup.Image{
+						Sources: []string{u.String()},
+						Hash:    hash.Hex(),
+					}
+					images[role][arch] = append(images[role][arch], image)
+				}
+			}
+		}
 
 		if isMaster {
 			for _, etcdCluster := range cluster.Spec.EtcdClusters {