diff --git a/data/data/bootstrap/files/usr/local/bin/bootkube.sh.template b/data/data/bootstrap/files/usr/local/bin/bootkube.sh.template
index c49dfde94c6..d681f3afdb4 100755
--- a/data/data/bootstrap/files/usr/local/bin/bootkube.sh.template
+++ b/data/data/bootstrap/files/usr/local/bin/bootkube.sh.template
@@ -35,6 +35,23 @@ MDNS_PUBLISHER_IMAGE=$(image_for mdns-publisher)
 HAPROXY_IMAGE=$(image_for haproxy-router)
 BAREMETAL_RUNTIMECFG_IMAGE=$(image_for baremetal-runtimecfg)
 
+# Copy machine-config-daemon binary from payload and run pivot
+if [ ! -f .pivot-done ]; then
+  mkdir /run/pivot /etc/pivot
+  touch /run/pivot/reboot-needed
+  echo "${MACHINE_CONFIG_OSCONTENT}" > /etc/pivot/image-pullspec
+
+  mkdir bin/
+  bootkube_podman_run \
+		--volume "$PWD/bin:/host/usr/local/bin:z" \
+    --entrypoint=sh \
+		"${MACHINE_CONFIG_OPERATOR_IMAGE}" \
+    -c "cp /usr/bin/machine-config-daemon /host/usr/local/bin"
+
+  touch .pivot-done
+  ./bin/machine-config-daemon pivot
+fi
+
 # Now, as early as possible we replace the pause image and reload crio to use it, to ensure
 # that we're using the pause image from our payload just like the primary cluster.
 # The config should match the one generated by the MCO ideally: