diff --git a/data/data/bootstrap/files/root/.docker/config.json.template b/data/data/bootstrap/files/root/.docker/config.json.template
new file mode 100644
index 00000000000..a33d92da44a
--- /dev/null
+++ b/data/data/bootstrap/files/root/.docker/config.json.template
@@ -0,0 +1 @@
+{{.PullSecret}}
diff --git a/data/data/manifests/bootkube/pull.yaml.template b/data/data/manifests/bootkube/pull.yaml.template
index 980ba3ee35a..08ffd7bb452 100644
--- a/data/data/manifests/bootkube/pull.yaml.template
+++ b/data/data/manifests/bootkube/pull.yaml.template
@@ -7,6 +7,6 @@
     "name": "coreos-pull-secret"
   },
   "data": {
-    ".dockerconfigjson": "{{.PullSecret}}"
+    ".dockerconfigjson": "{{.PullSecretBase64}}"
   }
 }
diff --git a/pkg/asset/ignition/bootstrap/bootstrap.go b/pkg/asset/ignition/bootstrap/bootstrap.go
index e52113cf6f3..b70d64f7d64 100644
--- a/pkg/asset/ignition/bootstrap/bootstrap.go
+++ b/pkg/asset/ignition/bootstrap/bootstrap.go
@@ -40,6 +40,7 @@ type bootstrapTemplateData struct {
 	EtcdCertSignerImage   string
 	EtcdCluster           string
 	EtcdctlImage          string
+	PullSecret            string
 	ReleaseImage          string
 	AdminKubeConfigBase64 string
 }
@@ -148,6 +149,7 @@ func (a *Bootstrap) getTemplateData(installConfig *types.InstallConfig, adminKub
 	return &bootstrapTemplateData{
 		EtcdCertSignerImage:   "quay.io/coreos/kube-etcd-signer-server:678cc8e6841e2121ebfdb6e2db568fce290b67d6",
 		EtcdctlImage:          "quay.io/coreos/etcd:v3.2.14",
+		PullSecret:            installConfig.PullSecret,
 		ReleaseImage:          releaseImage,
 		EtcdCluster:           strings.Join(etcdEndpoints, ","),
 		AdminKubeConfigBase64: base64.StdEncoding.EncodeToString(adminKubeConfig),
diff --git a/pkg/asset/manifests/operators.go b/pkg/asset/manifests/operators.go
index fa89ae974a9..e422d10fe24 100644
--- a/pkg/asset/manifests/operators.go
+++ b/pkg/asset/manifests/operators.go
@@ -150,7 +150,7 @@ func (m *Manifests) generateBootKubeManifests(dependencies asset.Parents) []*ass
 		KubeCaKey:                       base64.StdEncoding.EncodeToString(kubeCA.Key()),
 		McsTLSCert:                      base64.StdEncoding.EncodeToString(mcsCertKey.Cert()),
 		McsTLSKey:                       base64.StdEncoding.EncodeToString(mcsCertKey.Key()),
-		PullSecret:                      base64.StdEncoding.EncodeToString([]byte(installConfig.Config.PullSecret)),
+		PullSecretBase64:                base64.StdEncoding.EncodeToString([]byte(installConfig.Config.PullSecret)),
 		RootCaCert:                      string(rootCA.Cert()),
 		ServiceServingCaCert:            base64.StdEncoding.EncodeToString(serviceServingCA.Cert()),
 		ServiceServingCaKey:             base64.StdEncoding.EncodeToString(serviceServingCA.Key()),
diff --git a/pkg/asset/manifests/template.go b/pkg/asset/manifests/template.go
index 71dbdefecd8..455cb5bd3f8 100644
--- a/pkg/asset/manifests/template.go
+++ b/pkg/asset/manifests/template.go
@@ -25,7 +25,7 @@ type bootkubeTemplateData struct {
 	KubeCaKey                       string
 	McsTLSCert                      string
 	McsTLSKey                       string
-	PullSecret                      string
+	PullSecretBase64                string
 	RootCaCert                      string
 	ServiceServingCaCert            string
 	ServiceServingCaKey             string