diff --git a/config/cluster/spec.go b/config/cluster/spec.go
index bb9730dd..d7b9a665 100644
--- a/config/cluster/spec.go
+++ b/config/cluster/spec.go
@@ -1,6 +1,10 @@
 package cluster
 
-import "github.com/creasty/defaults"
+import (
+	"fmt"
+
+	"github.com/creasty/defaults"
+)
 
 // Spec defines cluster config spec section
 type Spec struct {
@@ -44,3 +48,25 @@ func (s *Spec) K0sLeader() *Host {
 
 	return s.k0sLeader
 }
+
+// KubeAPIURL returns an url to the cluster's kube api
+func (s *Spec) KubeAPIURL() string {
+	var caddr string
+	if a := s.K0s.Config.DigString("spec", "api", "externalAddress"); a != "" {
+		caddr = a
+	} else {
+		leader := s.K0sLeader()
+		if leader.PrivateAddress != "" {
+			caddr = leader.PrivateAddress
+		} else {
+			caddr = leader.Address()
+		}
+	}
+
+	cport := 6443
+	if p, ok := s.K0s.Config.Dig("spec", "api", "port").(int); ok {
+		cport = p
+	}
+
+	return fmt.Sprintf("https://%s:%d", caddr, cport)
+}
diff --git a/phase/install_workers.go b/phase/install_workers.go
index 9f29c7fd..a3c211b9 100644
--- a/phase/install_workers.go
+++ b/phase/install_workers.go
@@ -1,6 +1,7 @@
 package phase
 
 import (
+	"fmt"
 	"time"
 
 	"github.com/k0sproject/k0sctl/config"
@@ -50,6 +51,21 @@ func (p *InstallWorkers) CleanUp() {
 
 // Run the phase
 func (p *InstallWorkers) Run() error {
+	url := p.Config.Spec.KubeAPIURL()
+	healthz := fmt.Sprintf("%s/healthz", url)
+
+	err := p.hosts.ParallelEach(func(h *cluster.Host) error {
+		log.Infof("%s: validating api connection to %s", h, url)
+		if err := h.CheckHTTPStatus(healthz, 200, 401); err != nil {
+			return fmt.Errorf("failed to connect from worker to kubernetes api at %s - check networking", url)
+		}
+		return nil
+	})
+
+	if err != nil {
+		return err
+	}
+
 	log.Infof("%s: generating token", p.leader)
 	token, err := p.Config.Spec.K0s.GenerateToken(
 		p.leader,