diff --git a/metropolis/node/BUILD.bazel b/metropolis/node/BUILD.bazel
index f75dd2a..1ace829 100644
--- a/metropolis/node/BUILD.bazel
+++ b/metropolis/node/BUILD.bazel
@@ -14,7 +14,10 @@
         "ports.go",
     ],
     importpath = "source.monogon.dev/metropolis/node",
-    visibility = ["//metropolis:__subpackages__"],
+    visibility = [
+        "//metropolis:__subpackages__",
+        "@io_k8s_kubernetes//pkg/registry:__subpackages__",
+    ],
     deps = ["@com_github_vishvananda_netlink//:netlink"],
 )
 
diff --git a/metropolis/node/kubernetes/apiserver.go b/metropolis/node/kubernetes/apiserver.go
index aeaa80e..9c4132d 100644
--- a/metropolis/node/kubernetes/apiserver.go
+++ b/metropolis/node/kubernetes/apiserver.go
@@ -120,6 +120,8 @@
 			pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: s.serviceAccountPrivKey})),
 		"--service-account-issuer", "https://metropolis.internal", // TODO: Figure out federation
 		fmt.Sprintf("--service-cluster-ip-range=%v", s.ServiceIPRange.String()),
+		// We use a patch for the allocator that prevents usage of system ports.
+		fmt.Sprintf("--service-node-port-range=1-65535"),
 		args.FileOpt("--tls-cert-file", "server-cert.pem",
 			pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: s.serverCert})),
 		args.FileOpt("--tls-private-key-file", "server-key.pem",
diff --git a/metropolis/node/ports.go b/metropolis/node/ports.go
index 50e9e9a..afa4b1a 100644
--- a/metropolis/node/ports.go
+++ b/metropolis/node/ports.go
@@ -16,7 +16,9 @@
 
 package node
 
-import "strconv"
+import (
+	"strconv"
+)
 
 // Port is a TCP and/or UDP port number reserved for and used by Metropolis
 // node code.
@@ -60,6 +62,20 @@
 	DebuggerPort Port = 2345
 )
 
+var SystemPorts = []Port{
+	CuratorServicePort,
+	ConsensusPort,
+	DebugServicePort,
+	WireGuardPort,
+	NodeManagement,
+	MetricsPort,
+	MetricsNodeListenerPort,
+	KubernetesAPIPort,
+	KubernetesAPIWrappedPort,
+	KubernetesWorkerLocalAPIPort,
+	DebuggerPort,
+}
+
 func (p Port) String() string {
 	switch p {
 	case CuratorServicePort: