diff --git a/roles/rke2/tasks/config_rke2.yml b/roles/rke2/tasks/config_rke2.yml
index 7d46a6684787b2f6fed7a821e2ba1e63c6d58797..a39ae2ea905eb0b4bdcde58a75e51bb53f8f4484 100644
--- a/roles/rke2/tasks/config_rke2.yml
+++ b/roles/rke2/tasks/config_rke2.yml
@@ -16,6 +16,25 @@
     - group_vars
     - group_vars/all
 
+
+- name: slurp token if upgrade
+  block:
+  - name: Load token
+    slurp:
+      src: "/var/lib/rancher/rke2/server/node-token"
+    register: slurped_token
+  - name: Decode token and store as fact at dummy master_host with host variable
+    add_host:
+      name: "MASTER_HOST"
+      token: "{{ slurped_token.content}}"
+  - name: create token
+    delegate_to: localhost
+    run_once: yes
+    set_fact:
+      token: "{{ hostvars['MASTER_HOST']['token'].split('server:')[1] }}"
+  when: upgrade and 'master' in group_names"
+
+
 - name: store token
   delegate_to: localhost
   become: no
diff --git a/roles/rke2/templates/manifests/deploy-openstack-ccm.j2 b/roles/rke2/templates/manifests/deploy-openstack-ccm.j2
index b4e87f0a36fc025a969978d7fc80451179be61b1..bf62cc11d5f45710a06bfd456b0e743d685e017f 100644
--- a/roles/rke2/templates/manifests/deploy-openstack-ccm.j2
+++ b/roles/rke2/templates/manifests/deploy-openstack-ccm.j2
@@ -42,6 +42,9 @@ spec:
       - key: node-role.kubernetes.io/master
         value: "true"
         effect: NoSchedule
+      - key: node-role.kubernetes.io/control-plane
+        value: "true"
+        effect: NoSchedule
       - key: CriticalAddonsOnly
         value: "true"
         effect: NoExecute