diff --git a/parts/linux/cloud-init/artifacts/acl/trident-acl-agent-override.conf b/parts/linux/cloud-init/artifacts/acl/trident-acl-agent-override.conf
index 0f5daca5659..6db0d7d8d83 100644
--- a/parts/linux/cloud-init/artifacts/acl/trident-acl-agent-override.conf
+++ b/parts/linux/cloud-init/artifacts/acl/trident-acl-agent-override.conf
@@ -42,3 +42,29 @@ ExecStartPre=-/usr/bin/sh -c '\
 for p in /var/lib/kubelet/kubeconfig /run/trident/trident.sock; do \
   [ -e "$p" ] && echo "trident-acl-agent preflight: present $p" || echo "trident-acl-agent preflight: MISSING $p"; \
 done'
+
+# Wait for kubelet TLS bootstrapping without polling the API server.
+TimeoutStartSec=150s
+ExecStartPre=/usr/bin/sh -c '\
+cert=/var/lib/kubelet/pki/kubelet-client-current.pem; \
+for i in $$(seq 1 60); do \
+  if [ -f /var/lib/kubelet/kubeconfig ] && [ -L "$$cert" ] && [ -f "$$cert" ]; then \
+    echo "trident-acl-agent preflight: kubelet TLS bootstrapping complete after $$i check(s)"; exit 0; \
+  fi; \
+  sleep 1; \
+done; \
+echo "trident-acl-agent preflight: kubelet TLS bootstrapping incomplete after 60 checks" >&2; \
+exit 1'
+
+# TLS bootstrapping can finish before Node registration. Wait locally, then
+# confirm the Node exists with one API request.
+ExecStartPre=/usr/bin/timeout 60s /usr/bin/sh -ec '\
+until journalctl -b -u kubelet.service --no-pager -q -o cat \
+    --grep="Successfully registered node" -n 1 | grep -q .; do \
+  sleep 1; \
+done; \
+sleep 1; \
+node="$$(hostname | tr "[:upper:]" "[:lower:]")"; \
+/opt/bin/kubectl --kubeconfig /var/lib/kubelet/kubeconfig \
+  --request-timeout=5s get node "$$node" >/dev/null; \
+echo "trident-acl-agent preflight: Node $$node registration confirmed"'