diff --git a/terraform/hetzner.tf b/terraform/hetzner.tf
index 9af67cb..41574e7 100644
--- a/terraform/hetzner.tf
+++ b/terraform/hetzner.tf
@@ -205,6 +205,7 @@ resource "hcloud_server" "server_k8s_test" {
     microk8s_setup : base64encode(templatefile("${path.module}/modules/k8s-cluster/templates/scripts/microk8s-setup.sh", {
       microk8s_channel : "1.28-strict/stable"
       main_node : true
+      manager_node : true
     }))
     cluster_setup_values : base64encode(templatefile("${path.module}/modules/k8s-cluster/templates/helm/cluster-setup-values.yaml", {
       client_id : var.vault_client_id
diff --git a/terraform/modules/k8s-cluster/manager-node.tf b/terraform/modules/k8s-cluster/manager-node.tf
index 1a8c68f..2766f48 100644
--- a/terraform/modules/k8s-cluster/manager-node.tf
+++ b/terraform/modules/k8s-cluster/manager-node.tf
@@ -107,6 +107,7 @@ resource "hcloud_server" "manager" {
     microk8s_setup : base64encode(templatefile("${path.module}/templates/scripts/microk8s-setup.sh", {
       microk8s_channel : var.microk8s_channel
       main_node = count.index == 0
+      manager_node : true
     }))
     cluster_setup_values : base64encode(templatefile("${path.module}/templates/helm/cluster-setup-values.yaml", {
       client_id : var.vault_service_principal.client_id
diff --git a/terraform/modules/k8s-cluster/templates/scripts/microk8s-setup.sh b/terraform/modules/k8s-cluster/templates/scripts/microk8s-setup.sh
index bbcec17..2e94ea6 100644
--- a/terraform/modules/k8s-cluster/templates/scripts/microk8s-setup.sh
+++ b/terraform/modules/k8s-cluster/templates/scripts/microk8s-setup.sh
@@ -6,3 +6,12 @@ mv /run/tmpfiles.d/microk8s.yaml /etc/microk8s.yaml
 sleep 120
 %{ endif ~}
 snap install microk8s --classic --channel "${microk8s_channel}"
+/snap/bin/microk8s addons repo remove core
+/snap/bin/microk8s addons repo add core https://github.com/canonical/microk8s-core-addons
+/snap/bin/microk8s addons repo add community https://github.com/canonical/microk8s-community-addons
+/snap/bin/microk8s enable cis-hardening
+/snap/bin/microk8s enable rbac
+%{ if manager_node ~}
+/snap/bin/microk8s enable ingress
+/snap/bin/microk8s enable cert-manager
+%{ endif ~}
diff --git a/terraform/modules/k8s-cluster/worker-node.tf b/terraform/modules/k8s-cluster/worker-node.tf
index 9e15dc7..fe6b9a4 100644
--- a/terraform/modules/k8s-cluster/worker-node.tf
+++ b/terraform/modules/k8s-cluster/worker-node.tf
@@ -86,6 +86,7 @@ resource "hcloud_server" "worker" {
     microk8s_setup : base64encode(templatefile("${path.module}/templates/scripts/microk8s-setup.sh", {
       microk8s_channel : var.microk8s_channel
       main_node : false
+      manager_node : false
     }))
     cluster_setup_values : base64encode(templatefile("${path.module}/templates/helm/cluster-setup-values.yaml", {
       client_id : var.vault_service_principal.client_id