diff --git a/cluster/gce/util.sh b/cluster/gce/util.sh
index e70a17a208f..f3a81d5c5cb 100755
--- a/cluster/gce/util.sh
+++ b/cluster/gce/util.sh
@@ -88,11 +88,13 @@ function set-linux-node-image() {
 function set-windows-node-image() {
   WINDOWS_NODE_IMAGE_PROJECT="windows-cloud"
   if [[ "${WINDOWS_NODE_OS_DISTRIBUTION}" == "win2019" ]]; then
-    WINDOWS_NODE_IMAGE="windows-server-2019-dc-core-for-containers-v20200908"
+    WINDOWS_NODE_IMAGE="windows-server-2019-dc-core-v20210112"
   elif [[ "${WINDOWS_NODE_OS_DISTRIBUTION}" == "win1909" ]]; then
-    WINDOWS_NODE_IMAGE="windows-server-1909-dc-core-for-containers-v20200908"
-  elif [[ "${WINDOWS_NODE_OS_DISTRIBUTION}" == "win1809" ]]; then
-    WINDOWS_NODE_IMAGE="windows-server-1809-dc-core-for-containers-v20200908"
+    WINDOWS_NODE_IMAGE="windows-server-1909-dc-core-v20210112"
+  elif [[ "${WINDOWS_NODE_OS_DISTRIBUTION}" == "win2004" ]]; then
+    WINDOWS_NODE_IMAGE="windows-server-2004-dc-core-v20210112"
+  elif [[ "${WINDOWS_NODE_OS_DISTRIBUTION,,}" == "win20h2" ]]; then
+    WINDOWS_NODE_IMAGE="windows-server-20h2-dc-core-v20210112"
   else
     echo "Unknown WINDOWS_NODE_OS_DISTRIBUTION ${WINDOWS_NODE_OS_DISTRIBUTION}" >&2
     exit 1
diff --git a/cluster/gce/windows/configure.ps1 b/cluster/gce/windows/configure.ps1
index 6cd31b48280..25ecfa57357 100644
--- a/cluster/gce/windows/configure.ps1
+++ b/cluster/gce/windows/configure.ps1
@@ -117,6 +117,26 @@ try {
   FetchAndImport-ModuleFromMetadata 'k8s-node-setup-psm1' 'k8s-node-setup.psm1'
 
   Dump-DebugInfoToConsole
+
+  if (-not (Test-ContainersFeatureInstalled)) {
+    Install-ContainersFeature
+    Log-Output 'Restarting computer after enabling Windows Containers feature'
+    Restart-Computer -Force
+    # Restart-Computer does not stop the rest of the script from executing.
+    exit 0
+  }
+
+  if (-not (Test-DockerIsInstalled)) {
+    Install-Docker
+  }
+  # For some reason the docker service may not be started automatically on the
+  # first reboot, although it seems to work fine on subsequent reboots.
+  Restart-Service docker
+  Start-Sleep 5
+  if (-not (Test-DockerIsRunning)) {
+      throw "docker service failed to start or stay running"
+  }
+
   Set-PrerequisiteOptions
   $kube_env = Fetch-KubeEnv
 
diff --git a/cluster/gce/windows/k8s-node-setup.psm1 b/cluster/gce/windows/k8s-node-setup.psm1
index 61484bf800f..f19025682aa 100644
--- a/cluster/gce/windows/k8s-node-setup.psm1
+++ b/cluster/gce/windows/k8s-node-setup.psm1
@@ -1321,6 +1321,46 @@ function Setup-ContainerRuntime {
   }
 }
 
+function Test-ContainersFeatureInstalled {
+  return (Get-WindowsFeature Containers).Installed
+}
+
+# After this function returns, the computer must be restarted to complete
+# the installation!
+function Install-ContainersFeature {
+  Log-Output "Installing Windows 'Containers' feature"
+  Install-WindowsFeature Containers
+}
+
+function Test-DockerIsInstalled {
+  return ((Get-Package `
+               -ProviderName DockerMsftProvider `
+               -ErrorAction SilentlyContinue |
+           Where-Object Name -eq 'docker') -ne $null)
+}
+
+function Test-DockerIsRunning {
+  return ((Get-Service docker).Status -eq 'Running')
+}
+
+# Installs Docker EE via the DockerMsftProvider. Ensure that the Windows
+# Containers feature is installed before calling this function; otherwise,
+# a restart may be needed after this function returns.
+function Install-Docker {
+  Log-Output 'Installing NuGet module'
+  Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force
+
+  Log-Output 'Installing DockerMsftProvider module'
+  Install-Module -Name DockerMsftProvider -Repository PSGallery -Force
+
+  Log-Output "Installing latest Docker EE version"
+  Install-Package `
+      -Name docker `
+      -ProviderName DockerMsftProvider `
+      -Force `
+      -Verbose
+}
+
 # Add a registry key for docker in EventLog so that log messages are mapped
 # correctly. This is a workaround since the key is missing in the base image.
 # https://github.com/MicrosoftDocs/Virtualization-Documentation/pull/503