diff --git a/cluster/plan.go b/cluster/plan.go
index 2c70bd79..85de3293 100644
--- a/cluster/plan.go
+++ b/cluster/plan.go
@@ -199,6 +199,11 @@ func (c *Cluster) BuildKubeAPIProcess(prefixPath string) v3.Process {
 		baseEnabledAdmissionPlugins = append(baseEnabledAdmissionPlugins, "PodSecurityPolicy")
 	}
 
+	// AlwaysPullImages
+	if c.Services.KubeAPI.AlwaysPullImages {
+		baseEnabledAdmissionPlugins = append(baseEnabledAdmissionPlugins, "AlwaysPullImages")
+	}
+
 	// Admission control plugins
 	// Resolution order:
 	//   k8s_defaults.go K8sVersionServiceOptions