diff --git a/build/build-image/cross/Dockerfile b/build/build-image/cross/Dockerfile
index 8f5c117abec..384dff23b09 100644
--- a/build/build-image/cross/Dockerfile
+++ b/build/build-image/cross/Dockerfile
@@ -72,7 +72,7 @@ RUN mkdir $TMPDIR \
             github.com/jteeuwen/go-bindata/go-bindata
 
 # Download and symlink etcd. We need this for our integration tests.
-RUN export ETCD_VERSION=v2.2.1; \
+RUN export ETCD_VERSION=v3.0.10; \
   mkdir -p /usr/local/src/etcd \
   && cd /usr/local/src/etcd \
   && curl -fsSL https://github.com/coreos/etcd/releases/download/${ETCD_VERSION}/etcd-${ETCD_VERSION}-linux-amd64.tar.gz | tar -xz \
diff --git a/build/build-image/cross/VERSION b/build/build-image/cross/VERSION
index 23f60f9010d..38e95fa7593 100644
--- a/build/build-image/cross/VERSION
+++ b/build/build-image/cross/VERSION
@@ -1 +1 @@
-v1.6.3-8
+v1.6.3-9
diff --git a/hack/lib/etcd.sh b/hack/lib/etcd.sh
index 09962289503..c99dcebeb88 100644
--- a/hack/lib/etcd.sh
+++ b/hack/lib/etcd.sh
@@ -16,7 +16,7 @@
 
 # A set of helpers for starting/running etcd for tests
 
-ETCD_VERSION=${ETCD_VERSION:-2.2.1}
+ETCD_VERSION=${ETCD_VERSION:-3.0.10}
 ETCD_HOST=${ETCD_HOST:-127.0.0.1}
 ETCD_PORT=${ETCD_PORT:-2379}
 
diff --git a/hack/test-update-storage-objects.sh b/hack/test-update-storage-objects.sh
index 9885aeacad3..bcb98f271d7 100755
--- a/hack/test-update-storage-objects.sh
+++ b/hack/test-update-storage-objects.sh
@@ -157,15 +157,14 @@ killApiServer
 # We always perform offline migration, so we need to stop etcd.
 #######################################################
 
-# TODO: Uncomment once we support migration.
-#kube::etcd::stop
-#TARGET_STORAGE="etcd3" \
-#  DATA_DIRECTORY="${ETCD_DIR}" \
-#  ETCD=$(which etcd) \
-#  ETCDCTL=$(which etcdctl) \
-#  ATTACHLEASE="${KUBE_OUTPUT_HOSTBIN}/attachlease" \
-#  ${KUBE_ROOT}/cluster/images/etcd/migrate-if-needed.sh
-#kube::etcd::start
+kube::etcd::stop
+TARGET_STORAGE="etcd3" \
+  DATA_DIRECTORY="${ETCD_DIR}" \
+  ETCD=$(which etcd) \
+  ETCDCTL=$(which etcdctl) \
+  ATTACHLEASE="${KUBE_OUTPUT_HOSTBIN}/attachlease" \
+  ${KUBE_ROOT}/cluster/images/etcd/migrate-if-needed.sh
+kube::etcd::start
 
 
 #######################################################
@@ -176,8 +175,7 @@ killApiServer
 
 KUBE_API_VERSIONS="${KUBE_NEW_API_VERSION},${KUBE_OLD_API_VERSION}"
 RUNTIME_CONFIG="api/all=false,api/${KUBE_OLD_API_VERSION}=true,api/${KUBE_NEW_API_VERSION}=true"
-# TODO: Switch to STORAGE_BACKEND_ETCD3 once we support it.
-startApiServer ${STORAGE_BACKEND_ETCD2} ${KUBE_NEW_STORAGE_VERSIONS} ${KUBE_STORAGE_MEDIA_TYPE_JSON}
+startApiServer ${STORAGE_BACKEND_ETCD3} ${KUBE_NEW_STORAGE_VERSIONS} ${KUBE_STORAGE_MEDIA_TYPE_JSON}
 
 # Update etcd objects, so that will now be stored in the new api version.
 kube::log::status "Updating storage versions in etcd"
@@ -192,8 +190,7 @@ for test in ${tests[@]}; do
   new_storage_version=${test_data[5]}
 
   kube::log::status "Verifying ${resource}/${namespace}/${name} has updated storage version ${new_storage_version} in etcd"
-  # note that should use flag --endpoints for etcdctl 3
-  ${ETCDCTL} --endpoint="${ETCD_HOST}:${ETCD_PORT}" get "/${ETCD_PREFIX}/${resource}/${namespace}/${name}" | grep ${new_storage_version}
+  ETCDCTL_API=3 ${ETCDCTL} --endpoints="${ETCD_HOST}:${ETCD_PORT}" get "/${ETCD_PREFIX}/${resource}/${namespace}/${name}" | grep ${new_storage_version}
 done
 
 killApiServer
@@ -209,8 +206,7 @@ RUNTIME_CONFIG="api/all=false,api/${KUBE_NEW_API_VERSION}=true"
 
 # This seems to reduce flakiness.
 sleep 1
-# TODO: Switch to STORAGE_BACKEND_ETCD3 once we support it.
-startApiServer ${STORAGE_BACKEND_ETCD2} ${KUBE_NEW_STORAGE_VERSIONS} ${KUBE_STORAGE_MEDIA_TYPE_PROTOBUF}
+startApiServer ${STORAGE_BACKEND_ETCD3} ${KUBE_NEW_STORAGE_VERSIONS} ${KUBE_STORAGE_MEDIA_TYPE_PROTOBUF}
 
 for test in ${tests[@]}; do
   IFS=',' read -ra test_data <<<"$test"