diff --git a/metropolis/cli/metroctl/format.go b/metropolis/cli/metroctl/format.go
index d2c5ddf..41987ec 100644
--- a/metropolis/cli/metroctl/format.go
+++ b/metropolis/cli/metroctl/format.go
@@ -5,6 +5,8 @@
 	"io"
 	"log"
 	"os"
+	"sort"
+	"strings"
 
 	"source.monogon.dev/metropolis/node/core/identity"
 	apb "source.monogon.dev/metropolis/proto/api"
@@ -42,14 +44,18 @@
 		return err
 	}
 
-	var roles string
-	if n.Roles.KubernetesWorker != nil {
-		roles += "KubernetesWorker"
-	}
+	var roles []string
 	if n.Roles.ConsensusMember != nil {
-		roles += ",ConsensusMember"
+		roles = append(roles, "ConsensusMember")
 	}
-	if _, err := fmt.Fprintf(e.out, "\t%s", roles); err != nil {
+	if n.Roles.KubernetesController != nil {
+		roles = append(roles, "KubernetesController")
+	}
+	if n.Roles.KubernetesWorker != nil {
+		roles = append(roles, "KubernetesWorker")
+	}
+	sort.Strings(roles)
+	if _, err := fmt.Fprintf(e.out, "\t%s", strings.Join(roles, ",")); err != nil {
 		return err
 	}
 
diff --git a/metropolis/cli/metroctl/set.go b/metropolis/cli/metroctl/set.go
index 2d6eaf9..b0bfaf5 100644
--- a/metropolis/cli/metroctl/set.go
+++ b/metropolis/cli/metroctl/set.go
@@ -23,7 +23,7 @@
 
 var addRoleCmd = &cobra.Command{
 	Short:   "Updates node roles.",
-	Use:     "role <KubernetesWorker|ConsensusMember> [NodeID, ...]",
+	Use:     "role <KubernetesController|KubernetesWorker|ConsensusMember> [NodeID, ...]",
 	Example: "metroctl node add role KubernetesWorker metropolis-25fa5f5e9349381d4a5e9e59de0215e3",
 	Args:    cobra.ArbitraryArgs,
 	Run:     doAdd,
@@ -31,7 +31,7 @@
 
 var removeRoleCmd = &cobra.Command{
 	Short:   "Updates node roles.",
-	Use:     "role <KubernetesWorker|ConsensusMember> [NodeID, ...]",
+	Use:     "role <KubernetesController|KubernetesWorker|ConsensusMember> [NodeID, ...]",
 	Example: "metroctl node remove role KubernetesWorker metropolis-25fa5f5e9349381d4a5e9e59de0215e3",
 	Args:    cobra.ArbitraryArgs,
 	Run:     doRemove,
@@ -65,6 +65,8 @@
 			},
 		}
 		switch role {
+		case "kubernetescontroller", "kc":
+			req.KubernetesController = opt(true)
 		case "kubernetesworker", "kw":
 			req.KubernetesWorker = opt(true)
 		case "consensusmember", "cm":
@@ -77,7 +79,7 @@
 		if err != nil {
 			log.Printf("Couldn't update node \"%s\": %v", node, err)
 		}
-		log.Printf("Updated node %s. Must be one of: KubernetesWorker, ConsensusMember.", node)
+		log.Printf("Updated node %s.", node)
 	}
 }
 
@@ -101,6 +103,8 @@
 			},
 		}
 		switch role {
+		case "kubernetescontroller", "kc":
+			req.KubernetesController = opt(false)
 		case "kubernetesworker", "kw":
 			req.KubernetesWorker = opt(false)
 		case "consensusmember", "cm":
diff --git a/metropolis/cli/metroctl/test/test.go b/metropolis/cli/metroctl/test/test.go
index e8310d7..a88a2e0 100644
--- a/metropolis/cli/metroctl/test/test.go
+++ b/metropolis/cli/metroctl/test/test.go
@@ -244,8 +244,8 @@
 			if onstatus != "HEALTHY" {
 				return fmt.Errorf("node status mismatch")
 			}
-			if onroles != "KubernetesWorker,ConsensusMember" {
-				return fmt.Errorf("node role mismatch")
+			if want, got := "ConsensusMember,KubernetesController", onroles; want != got {
+				return fmt.Errorf("node role mismatch: wanted %q, got %q", want, got)
 			}
 			if ontimeout < 0 || ontimeout > 30 {
 				return fmt.Errorf("node timeout mismatch")
@@ -254,44 +254,44 @@
 		})
 	})
 	t.Run("set/unset role", func(t *testing.T) {
-		util.TestEventual(t, "metroctl set/unset role KubernetesWorker", ctx, 10*time.Second, func(ctx context.Context) error {
+		util.TestEventual(t, "metroctl set/unset role KubernetesController", ctx, 10*time.Second, func(ctx context.Context) error {
 			nid := cl.NodeIDs[1]
 			naddr := cl.Nodes[nid].ManagementAddress
 
 			// In this test we'll unset a node role, make sure that it's been in fact
 			// unset, then set it again, and check again. This exercises commands of
-			// the form "metroctl set/unset role KubernetesWorker [NodeID, ...]".
+			// the form "metroctl set/unset role KubernetesController [NodeID, ...]".
 
-			// Check that KubernetesWorker role is set initially.
+			// Check that KubernetesController role is set initially.
 			var describeArgs []string
 			describeArgs = append(describeArgs, commonOpts...)
 			describeArgs = append(describeArgs, endpointOpts...)
 			describeArgs = append(describeArgs, "node", "describe", "--filter", fmt.Sprintf("node.status.external_address==\"%s\"", naddr))
-			if err := mctlFailIfMissing(t, ctx, describeArgs, "KubernetesWorker"); err != nil {
+			if err := mctlFailIfMissing(t, ctx, describeArgs, "KubernetesController"); err != nil {
 				return err
 			}
 			// Remove the role.
 			var unsetArgs []string
 			unsetArgs = append(unsetArgs, commonOpts...)
 			unsetArgs = append(unsetArgs, endpointOpts...)
-			unsetArgs = append(unsetArgs, "node", "remove", "role", "KubernetesWorker", nid)
+			unsetArgs = append(unsetArgs, "node", "remove", "role", "KubernetesController", nid)
 			if err := mctlRun(t, ctx, unsetArgs); err != nil {
 				return err
 			}
 			// Check that the role is unset.
-			if err := mctlFailIfFound(t, ctx, describeArgs, "KubernetesWorker"); err != nil {
+			if err := mctlFailIfFound(t, ctx, describeArgs, "KubernetesController"); err != nil {
 				return err
 			}
 			// Set the role back to the initial value.
 			var setArgs []string
 			setArgs = append(setArgs, commonOpts...)
 			setArgs = append(setArgs, endpointOpts...)
-			setArgs = append(setArgs, "node", "add", "role", "KubernetesWorker", nid)
+			setArgs = append(setArgs, "node", "add", "role", "KubernetesController", nid)
 			if err := mctlRun(t, ctx, setArgs); err != nil {
 				return err
 			}
 			// Chack that the role is set.
-			return mctlFailIfMissing(t, ctx, describeArgs, "KubernetesWorker")
+			return mctlFailIfMissing(t, ctx, describeArgs, "KubernetesController")
 		})
 	})
 }