diff --git a/cluster/gce/coreos/helper.sh b/cluster/gce/coreos/helper.sh
index 6e289eac21c..bf3c373402c 100644
--- a/cluster/gce/coreos/helper.sh
+++ b/cluster/gce/coreos/helper.sh
@@ -69,9 +69,6 @@ ENABLE_CLUSTER_DNS=$(yaml-quote ${ENABLE_CLUSTER_DNS:-false})
 DNS_REPLICAS=$(yaml-quote ${DNS_REPLICAS:-})
 DNS_SERVER_IP=$(yaml-quote ${DNS_SERVER_IP:-})
 DNS_DOMAIN=$(yaml-quote ${DNS_DOMAIN:-})
-KUBE_USER=$(yaml-quote ${KUBE_USER})
-KUBE_PASSWORD=$(yaml-quote ${KUBE_PASSWORD})
-KUBE_BEARER_TOKEN=$(yaml-quote ${KUBE_BEARER_TOKEN})
 KUBELET_TOKEN=$(yaml-quote ${KUBELET_TOKEN:-})
 KUBE_PROXY_TOKEN=$(yaml-quote ${KUBE_PROXY_TOKEN:-})
 ADMISSION_CONTROL=$(yaml-quote ${ADMISSION_CONTROL:-})
diff --git a/cluster/gce/coreos/node.yaml b/cluster/gce/coreos/node.yaml
index 884074fa14a..97daf77fa6c 100644
--- a/cluster/gce/coreos/node.yaml
+++ b/cluster/gce/coreos/node.yaml
@@ -17,7 +17,7 @@ write_files:
       source /etc/kube-env
 
       /usr/bin/mkdir -p /var/lib/kubelet
-      /bin/echo  {\"BearerToken\": \"${KUBE_BEARER_TOKEN}\", \"Insecure\": true } > /var/lib/kubelet/kubernetes_auth
+      /bin/echo  {\"BearerToken\": \"${KUBELET_TOKEN}\", \"Insecure\": true } > /var/lib/kubelet/kubernetes_auth
   - path: /run/config-kube-proxy.sh
     permissions: "0755"
     content: |
diff --git a/cluster/gce/debian/helper.sh b/cluster/gce/debian/helper.sh
index e0ccee796ae..17367328532 100644
--- a/cluster/gce/debian/helper.sh
+++ b/cluster/gce/debian/helper.sh
@@ -41,16 +41,21 @@ ENABLE_CLUSTER_DNS: $(yaml-quote ${ENABLE_CLUSTER_DNS:-false})
 DNS_REPLICAS: $(yaml-quote ${DNS_REPLICAS:-})
 DNS_SERVER_IP: $(yaml-quote ${DNS_SERVER_IP:-})
 DNS_DOMAIN: $(yaml-quote ${DNS_DOMAIN:-})
-KUBE_USER: $(yaml-quote ${KUBE_USER})
-KUBE_PASSWORD: $(yaml-quote ${KUBE_PASSWORD})
-KUBE_BEARER_TOKEN: $(yaml-quote ${KUBE_BEARER_TOKEN})
 KUBELET_TOKEN: $(yaml-quote ${KUBELET_TOKEN:-})
 KUBE_PROXY_TOKEN: $(yaml-quote ${KUBE_PROXY_TOKEN:-})
 ADMISSION_CONTROL: $(yaml-quote ${ADMISSION_CONTROL:-})
 MASTER_IP_RANGE: $(yaml-quote ${MASTER_IP_RANGE})
 EOF
 
-  if [[ "${master}" != "true" ]]; then
+  if [[ "${master}" == "true" ]]; then
+    # Master-only env vars.
+    cat >>$file <<EOF
+KUBE_USER: $(yaml-quote ${KUBE_USER})
+KUBE_PASSWORD: $(yaml-quote ${KUBE_PASSWORD})
+KUBE_BEARER_TOKEN: $(yaml-quote ${KUBE_BEARER_TOKEN})
+EOF
+  else
+    # Node-only env vars.
     cat >>$file <<EOF
 KUBERNETES_MASTER_NAME: $(yaml-quote ${MASTER_NAME})
 ZONE: $(yaml-quote ${ZONE})