diff --git a/pkg/bootstrap/bootstrap.go b/pkg/bootstrap/bootstrap.go
index 1312624410..d6df6e56db 100644
--- a/pkg/bootstrap/bootstrap.go
+++ b/pkg/bootstrap/bootstrap.go
@@ -107,10 +107,12 @@ func Stage(resolver *images.Resolver, nodeConfig *daemonconfig.Node, cfg cmds.Ag
 		// If we didn't find the requested image in a tarball, pull it from the remote registry.
 		// Note that this will fail (potentially after a long delay) if the registry cannot be reached.
 		if img == nil {
-			registry, err := registries.GetPrivateRegistries(nodeConfig.AgentConfig.PrivateRegistry)
+			registry, err := registries.GetPrivateRegistries(cfg.PrivateRegistry)
 			if err != nil {
-				return "", errors.Wrapf(err, "failed to load private registry configuration from %s", nodeConfig.AgentConfig.PrivateRegistry)
+				return "", errors.Wrapf(err, "failed to load private registry configuration from %s", cfg.PrivateRegistry)
 			}
+			// Override registry config with version provided by (and potentially modified by) k3s agent setup
+			registry.Registry = nodeConfig.AgentConfig.Registry
 
 			// Try to enable Kubelet image credential provider plugins; fall back to legacy docker credentials
 			if agent.ImageCredProvAvailable(&nodeConfig.AgentConfig) {
@@ -124,6 +126,8 @@ func Stage(resolver *images.Resolver, nodeConfig *daemonconfig.Node, cfg cmds.Ag
 			}
 
 			logrus.Infof("Pulling runtime image %s", ref.Name())
+			// Make sure that the runtime image is also loaded into containerd
+			images.Pull(imagesDir, images.Runtime, ref)
 			img, err = registry.Image(ref, remote.WithPlatform(v1.Platform{Architecture: runtime.GOARCH, OS: runtime.GOOS}))
 			if err != nil {
 				return "", errors.Wrapf(err, "failed to get runtime image %s", ref.Name())
diff --git a/pkg/cli/cmds/agent.go b/pkg/cli/cmds/agent.go
index fd842e8187..f978cf8331 100644
--- a/pkg/cli/cmds/agent.go
+++ b/pkg/cli/cmds/agent.go
@@ -30,6 +30,7 @@ var (
 		"image-credential-provider-config":  copyFlag,
 		"docker":                            dropFlag,
 		"container-runtime-endpoint":        copyFlag,
+		"disable-default-registry-endpoint": copyFlag,
 		"image-service-endpoint":            dropFlag,
 		"pause-image":                       dropFlag,
 		"default-runtime":                   copyFlag,
diff --git a/pkg/cli/cmds/server.go b/pkg/cli/cmds/server.go
index 48f0f0a44a..aeef46c4ed 100644
--- a/pkg/cli/cmds/server.go
+++ b/pkg/cli/cmds/server.go
@@ -102,6 +102,8 @@ var (
 		"image-credential-provider-config":  copyFlag,
 		"docker":                            dropFlag,
 		"container-runtime-endpoint":        copyFlag,
+		"disable-default-registry-endpoint": copyFlag,
+		"embedded-registry":                 copyFlag,
 		"pause-image":                       dropFlag,
 		"default-runtime":                   copyFlag,
 		"private-registry":                  copyFlag,