--- a/ansible/bootstrap.yml
+++ b/ansible/bootstrap.yml
@@ -9,7 +9,6 @@
   vars:
     k3s_version: "v1.35.1+k3s1"
     helm_version: "v3.17.3"
-    kubeconfig_local_path: "~/.kube/config-hosteurope"
 
   tasks:
     # ── Base packages ────────────────────────────────────────────────────────
@@ -27,7 +26,7 @@
       shell: |
         curl -sfL https://get.k3s.io | \
           INSTALL_K3S_VERSION="{{ k3s_version }}" \
-          INSTALL_K3S_EXEC="server --cluster-init --write-kubeconfig-mode=644" \
+          INSTALL_K3S_EXEC="server --cluster-init --write-kubeconfig-mode=600" \
           sh -
       args:
         creates: /usr/local/bin/k3s
@@ -77,17 +76,11 @@
 
     - debug: var=helm_ver.stdout
 
-    # ── Kubeconfig ───────────────────────────────────────────────────────────
-    - name: Fetch kubeconfig to control node
-      fetch:
-        src: /etc/rancher/k3s/k3s.yaml
-        dest: "{{ kubeconfig_local_path }}"
-        flat: yes
-
-    - name: Fix server address in fetched kubeconfig
-      delegate_to: localhost
-      become: false
-      replace:
-        path: "{{ kubeconfig_local_path }}"
-        regexp: 'server: https://127\.0\.0\.1:6443'
-        replace: "server: https://{{ ansible_host }}:6443"
+    # Admin kubeconfig stays on the host. Attended administration uses
+    # sudo k3s kubectl; agent identity issuance belongs to railiance-platform.
+    - name: Restrict existing admin kubeconfig permissions
+      ansible.builtin.file:
+        path: /etc/rancher/k3s/k3s.yaml
+        owner: root
+        group: root
+        mode: "0600"