diff --git a/cluster/defaults.go b/cluster/defaults.go
index bbebc313..4378ee3b 100644
--- a/cluster/defaults.go
+++ b/cluster/defaults.go
@@ -258,6 +258,7 @@ func (c *Cluster) setClusterImageDefaults() error {
 		&c.SystemImages.CalicoNode:                d(imageDefaults.CalicoNode, privRegURL),
 		&c.SystemImages.CalicoCNI:                 d(imageDefaults.CalicoCNI, privRegURL),
 		&c.SystemImages.CalicoCtl:                 d(imageDefaults.CalicoCtl, privRegURL),
+		&c.SystemImages.CalicoControllers:         d(imageDefaults.CalicoControllers, privRegURL),
 		&c.SystemImages.CanalNode:                 d(imageDefaults.CanalNode, privRegURL),
 		&c.SystemImages.CanalCNI:                  d(imageDefaults.CanalCNI, privRegURL),
 		&c.SystemImages.CanalFlannel:              d(imageDefaults.CanalFlannel, privRegURL),
diff --git a/cluster/network.go b/cluster/network.go
index c2e6a6bc..169c8d75 100644
--- a/cluster/network.go
+++ b/cluster/network.go
@@ -175,13 +175,14 @@ func (c *Cluster) doFlannelDeploy(ctx context.Context, data map[string]interface
 func (c *Cluster) doCalicoDeploy(ctx context.Context, data map[string]interface{}) error {
 	clientConfig := pki.GetConfigPath(pki.KubeNodeCertName)
 	calicoConfig := map[string]interface{}{
-		KubeCfg:       clientConfig,
-		ClusterCIDR:   c.ClusterCIDR,
-		CNIImage:      c.SystemImages.CalicoCNI,
-		NodeImage:     c.SystemImages.CalicoNode,
-		Calicoctl:     c.SystemImages.CalicoCtl,
-		CloudProvider: c.Network.Options[CalicoCloudProvider],
-		RBACConfig:    c.Authorization.Mode,
+		KubeCfg:          clientConfig,
+		ClusterCIDR:      c.ClusterCIDR,
+		CNIImage:         c.SystemImages.CalicoCNI,
+		NodeImage:        c.SystemImages.CalicoNode,
+		Calicoctl:        c.SystemImages.CalicoCtl,
+		ControllersImage: c.SystemImages.CalicoControllers,
+		CloudProvider:    c.Network.Options[CalicoCloudProvider],
+		RBACConfig:       c.Authorization.Mode,
 	}
 	pluginYaml, err := c.getNetworkPluginManifest(calicoConfig, data)
 	if err != nil {