diff --git a/k8s-bootstrap/index.ts b/k8s-bootstrap/index.ts
index 2a27337..0eb11d7 100644
--- a/k8s-bootstrap/index.ts
+++ b/k8s-bootstrap/index.ts
@@ -23,11 +23,11 @@ const pve2ApiToken = infraRef.requireOutput(
 ) as pulumi.Output<string>;
 
 // Node IPs — static DHCP leases set in the router
-const master1Ip = config.require("master1Ip");
-const master2Ip = config.require("master2Ip");
-const master3Ip = config.require("master3Ip");
-const worker1Ip = config.require("worker1Ip");
-const worker2Ip = config.require("worker2Ip");
+const master1Ip = infraRef.requireOutput("master1Ip");
+const master2Ip = infraRef.requireOutput("master2Ip");
+const master3Ip = infraRef.requireOutput("master3Ip");
+const worker1Ip = infraRef.requireOutput("worker1Ip");
+const worker2Ip = infraRef.requireOutput("worker2Ip");
 
 // Pre-shared k3s cluster token
 const k3sToken = config.requireSecret("k3sToken");
@@ -47,7 +47,8 @@ const worker1VmId = vmIdsOutput.apply((ids) => String(ids.worker1));
 const worker2VmId = vmIdsOutput.apply((ids) => String(ids.worker2));
 
 // SSH connection helper
-function conn(ip: string): command.types.input.remote.ConnectionArgs {
+function conn(
+  ip: pulumi.Input<string>): command.types.input.remote.ConnectionArgs {
   return { host: ip, user: "ubuntu", privateKey: ciRunnerPrivateKey };
 }
 
@@ -97,7 +98,7 @@ const allStarts = [
 const waitMaster1Ssh = new command.local.Command(
   "wait-ssh-master-1",
   {
-    create: `for i in $(seq 1 60); do (timeout 5 bash -c "echo > /dev/tcp/${master1Ip}/22") 2>/dev/null && exit 0; sleep 5; done; exit 1`,
+    create: pulumi.interpolate`for i in $(seq 1 60); do (timeout 5 bash -c "echo > /dev/tcp/${master1Ip}/22") 2>/dev/null && exit 0; sleep 5; done; exit 1`,
     triggers: [master1VmId],
     interpreter: ["/bin/bash", "-c"],
   },
@@ -131,7 +132,7 @@ const waitK3sMaster1Ready = new command.remote.Command(
 const waitMaster2Ssh = new command.local.Command(
   "wait-ssh-master-2",
   {
-    create: `for i in $(seq 1 60); do (timeout 5 bash -c "echo > /dev/tcp/${master2Ip}/22") 2>/dev/null && exit 0; sleep 5; done; exit 1`,
+    create: pulumi.interpolate`for i in $(seq 1 60); do (timeout 5 bash -c "echo > /dev/tcp/${master2Ip}/22") 2>/dev/null && exit 0; sleep 5; done; exit 1`,
     triggers: [master2VmId],
     interpreter: ["/bin/bash", "-c"],
   },
@@ -141,7 +142,7 @@ const waitMaster2Ssh = new command.local.Command(
 const waitMaster3Ssh = new command.local.Command(
   "wait-ssh-master-3",
   {
-    create: `for i in $(seq 1 60); do (timeout 5 bash -c "echo > /dev/tcp/${master3Ip}/22") 2>/dev/null && exit 0; sleep 5; done; exit 1`,
+    create: pulumi.interpolate`for i in $(seq 1 60); do (timeout 5 bash -c "echo > /dev/tcp/${master3Ip}/22") 2>/dev/null && exit 0; sleep 5; done; exit 1`,
     triggers: [master3VmId],
     interpreter: ["/bin/bash", "-c"],
   },
@@ -175,7 +176,7 @@ const joinMaster3 = new command.remote.Command(
 const waitWorker1Ssh = new command.local.Command(
   "wait-ssh-worker-1",
   {
-    create: `for i in $(seq 1 60); do (timeout 5 bash -c "echo > /dev/tcp/${worker1Ip}/22") 2>/dev/null && exit 0; sleep 5; done; exit 1`,
+    create: pulumi.interpolate`for i in $(seq 1 60); do (timeout 5 bash -c "echo > /dev/tcp/${worker1Ip}/22") 2>/dev/null && exit 0; sleep 5; done; exit 1`,
     triggers: [worker1VmId],
     interpreter: ["/bin/bash", "-c"],
   },
@@ -185,7 +186,7 @@ const waitWorker1Ssh = new command.local.Command(
 const waitWorker2Ssh = new command.local.Command(
   "wait-ssh-worker-2",
   {
-    create: `for i in $(seq 1 60); do (timeout 5 bash -c "echo > /dev/tcp/${worker2Ip}/22") 2>/dev/null && exit 0; sleep 5; done; exit 1`,
+    create: pulumi.interpolate`for i in $(seq 1 60); do (timeout 5 bash -c "echo > /dev/tcp/${worker2Ip}/22") 2>/dev/null && exit 0; sleep 5; done; exit 1`,
     triggers: [worker2VmId],
     interpreter: ["/bin/bash", "-c"],
   },
@@ -226,8 +227,8 @@ const getKubeconfig = new command.remote.Command(
   { dependsOn: [joinWorker1, joinWorker2] },
 );
 
-export const kubeconfig = pulumi.secret(
-  getKubeconfig.stdout.apply((kc) =>
-    kc.replaceAll("127.0.0.1", master1Ip).trim(),
-  ),
-);
+ export const kubeconfig = pulumi.secret(
+   pulumi
+     .all([getKubeconfig.stdout, master1Ip])
+     .apply(([kc, ip]) => kc.replaceAll("127.0.0.1", ip as string).trim()),
+ );