diff --git a/ansible/roles/firstboot/files/ansible_payload/roles/metacluster/tasks/registry.yml b/ansible/roles/firstboot/files/ansible_payload/roles/metacluster/tasks/registry.yml
index 41790cf..6bd8bac 100644
--- a/ansible/roles/firstboot/files/ansible_payload/roles/metacluster/tasks/registry.yml
+++ b/ansible/roles/firstboot/files/ansible_payload/roles/metacluster/tasks/registry.yml
@@ -44,8 +44,22 @@
         dest: /etc/rancher/k3s/registries.yaml
         src: registries.j2
 
+    - name: Restart kubelet (k3s) to pick up configured registries
+      ansible.builtin.systemd:
+        name: k3s
+        state: restarted
+
+    - name: Ensure k3s API availability
+      ansible.builtin.uri:
+        url: https://{{ vapp['guestinfo.ipaddress'] }}:6443/livez?verbose
+        method: GET
+      register: api_readycheck
+      until: api_readycheck.json.apiVersion is defined
+      retries: 5
+      delay: 30
+
   module_defaults:
     ansible.builtin.uri:
       validate_certs: no
-      status_code: [200, 201]
+      status_code: [200, 201, 401]
       body_format: json