diff --git a/pkg/clusterapi/apibuilder.go b/pkg/clusterapi/apibuilder.go
index cce17c46f7d0..2f050fc05b7d 100644
--- a/pkg/clusterapi/apibuilder.go
+++ b/pkg/clusterapi/apibuilder.go
@@ -145,14 +145,16 @@ func KubeadmControlPlane(clusterSpec *cluster.Spec, infrastructureObject APIObje
 				},
 				InitConfiguration: &bootstrapv1.InitConfiguration{
 					NodeRegistration: bootstrapv1.NodeRegistrationOptions{
-						KubeletExtraArgs: SecureTlsCipherSuitesExtraArgs(),
-						Taints:           clusterSpec.Cluster.Spec.ControlPlaneConfiguration.Taints,
+						KubeletExtraArgs: SecureTlsCipherSuitesExtraArgs().
+							Append(ControlPlaneNodeLabelsExtraArgs(clusterSpec.Cluster.Spec.ControlPlaneConfiguration)),
+						Taints: clusterSpec.Cluster.Spec.ControlPlaneConfiguration.Taints,
 					},
 				},
 				JoinConfiguration: &bootstrapv1.JoinConfiguration{
 					NodeRegistration: bootstrapv1.NodeRegistrationOptions{
-						KubeletExtraArgs: SecureTlsCipherSuitesExtraArgs(),
-						Taints:           clusterSpec.Cluster.Spec.ControlPlaneConfiguration.Taints,
+						KubeletExtraArgs: SecureTlsCipherSuitesExtraArgs().
+							Append(ControlPlaneNodeLabelsExtraArgs(clusterSpec.Cluster.Spec.ControlPlaneConfiguration)),
+						Taints: clusterSpec.Cluster.Spec.ControlPlaneConfiguration.Taints,
 					},
 				},
 				PreKubeadmCommands:  []string{},
@@ -194,7 +196,7 @@ func KubeadmConfigTemplate(clusterSpec *cluster.Spec, workerNodeGroupConfig v1al
 					},
 					JoinConfiguration: &bootstrapv1.JoinConfiguration{
 						NodeRegistration: bootstrapv1.NodeRegistrationOptions{
-							KubeletExtraArgs: map[string]string{},
+							KubeletExtraArgs: WorkerNodeLabelsExtraArgs(workerNodeGroupConfig),
 							Taints:           workerNodeGroupConfig.Taints,
 						},
 					},
diff --git a/pkg/clusterapi/apibuilder_test.go b/pkg/clusterapi/apibuilder_test.go
index a00794b7401e..b4cf1f819c4e 100644
--- a/pkg/clusterapi/apibuilder_test.go
+++ b/pkg/clusterapi/apibuilder_test.go
@@ -77,6 +77,10 @@ func newApiBuilerTest(t *testing.T) apiBuilerTest {
 							TimeAdded: nil,
 						},
 					},
+					Labels: map[string]string{
+						"key1": "val1",
+						"key2": "val2",
+					},
 				},
 				KubernetesVersion: "1.21",
 			},
@@ -110,6 +114,9 @@ func newApiBuilerTest(t *testing.T) apiBuilerTest {
 				TimeAdded: nil,
 			},
 		},
+		Labels: map[string]string{
+			"key3": "val3",
+		},
 	}
 
 	kubeadmConfigTemplate := &bootstrapv1.KubeadmConfigTemplate{
@@ -246,7 +253,10 @@ func wantKubeadmControlPlane() *controlplanev1.KubeadmControlPlane {
 				},
 				InitConfiguration: &bootstrapv1.InitConfiguration{
 					NodeRegistration: bootstrapv1.NodeRegistrationOptions{
-						KubeletExtraArgs: tlsCipherSuitesArgs(),
+						KubeletExtraArgs: map[string]string{
+							"tls-cipher-suites": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+							"node-labels":       "key1=val1,key2=val2",
+						},
 						Taints: []v1.Taint{
 							{
 								Key:       "key1",
@@ -259,7 +269,10 @@ func wantKubeadmControlPlane() *controlplanev1.KubeadmControlPlane {
 				},
 				JoinConfiguration: &bootstrapv1.JoinConfiguration{
 					NodeRegistration: bootstrapv1.NodeRegistrationOptions{
-						KubeletExtraArgs: tlsCipherSuitesArgs(),
+						KubeletExtraArgs: map[string]string{
+							"tls-cipher-suites": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+							"node-labels":       "key1=val1,key2=val2",
+						},
 						Taints: []v1.Taint{
 							{
 								Key:       "key1",
@@ -314,7 +327,9 @@ func wantKubeadmConfigTemplate() *bootstrapv1.KubeadmConfigTemplate {
 					},
 					JoinConfiguration: &bootstrapv1.JoinConfiguration{
 						NodeRegistration: bootstrapv1.NodeRegistrationOptions{
-							KubeletExtraArgs: map[string]string{},
+							KubeletExtraArgs: map[string]string{
+								"node-labels": "key3=val3",
+							},
 							Taints: []v1.Taint{
 								{
 									Key:       "key2",
diff --git a/pkg/clusterapi/identity_test.go b/pkg/clusterapi/identity_test.go
index 2aa52088f670..09f7c5ceaa12 100644
--- a/pkg/clusterapi/identity_test.go
+++ b/pkg/clusterapi/identity_test.go
@@ -110,7 +110,10 @@ func TestConfigureAWSIAMAuthInKubeadmControlPlane(t *testing.T) {
 						},
 						InitConfiguration: &bootstrapv1.InitConfiguration{
 							NodeRegistration: bootstrapv1.NodeRegistrationOptions{
-								KubeletExtraArgs: tlsCipherSuitesArgs(),
+								KubeletExtraArgs: map[string]string{
+									"tls-cipher-suites": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+									"node-labels":       "key1=val1,key2=val2",
+								},
 								Taints: []v1.Taint{
 									{
 										Key:       "key1",
@@ -123,7 +126,10 @@ func TestConfigureAWSIAMAuthInKubeadmControlPlane(t *testing.T) {
 						},
 						JoinConfiguration: &bootstrapv1.JoinConfiguration{
 							NodeRegistration: bootstrapv1.NodeRegistrationOptions{
-								KubeletExtraArgs: tlsCipherSuitesArgs(),
+								KubeletExtraArgs: map[string]string{
+									"tls-cipher-suites": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+									"node-labels":       "key1=val1,key2=val2",
+								},
 								Taints: []v1.Taint{
 									{
 										Key:       "key1",
@@ -294,7 +300,10 @@ func TestConfigureOIDCInKubeadmControlPlane(t *testing.T) {
 						},
 						InitConfiguration: &bootstrapv1.InitConfiguration{
 							NodeRegistration: bootstrapv1.NodeRegistrationOptions{
-								KubeletExtraArgs: tlsCipherSuitesArgs(),
+								KubeletExtraArgs: map[string]string{
+									"tls-cipher-suites": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+									"node-labels":       "key1=val1,key2=val2",
+								},
 								Taints: []v1.Taint{
 									{
 										Key:       "key1",
@@ -307,7 +316,10 @@ func TestConfigureOIDCInKubeadmControlPlane(t *testing.T) {
 						},
 						JoinConfiguration: &bootstrapv1.JoinConfiguration{
 							NodeRegistration: bootstrapv1.NodeRegistrationOptions{
-								KubeletExtraArgs: tlsCipherSuitesArgs(),
+								KubeletExtraArgs: map[string]string{
+									"tls-cipher-suites": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+									"node-labels":       "key1=val1,key2=val2",
+								},
 								Taints: []v1.Taint{
 									{
 										Key:       "key1",
@@ -405,7 +417,10 @@ func TestConfigurePodIamAuthInKubeadmControlPlane(t *testing.T) {
 						},
 						InitConfiguration: &bootstrapv1.InitConfiguration{
 							NodeRegistration: bootstrapv1.NodeRegistrationOptions{
-								KubeletExtraArgs: tlsCipherSuitesArgs(),
+								KubeletExtraArgs: map[string]string{
+									"tls-cipher-suites": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+									"node-labels":       "key1=val1,key2=val2",
+								},
 								Taints: []v1.Taint{
 									{
 										Key:       "key1",
@@ -418,7 +433,10 @@ func TestConfigurePodIamAuthInKubeadmControlPlane(t *testing.T) {
 						},
 						JoinConfiguration: &bootstrapv1.JoinConfiguration{
 							NodeRegistration: bootstrapv1.NodeRegistrationOptions{
-								KubeletExtraArgs: tlsCipherSuitesArgs(),
+								KubeletExtraArgs: map[string]string{
+									"tls-cipher-suites": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+									"node-labels":       "key1=val1,key2=val2",
+								},
 								Taints: []v1.Taint{
 									{
 										Key:       "key1",