diff --git a/metropolis/node/kubernetes/controller-manager.go b/metropolis/node/kubernetes/controller-manager.go
index 8298de1..d26a2af 100644
--- a/metropolis/node/kubernetes/controller-manager.go
+++ b/metropolis/node/kubernetes/controller-manager.go
@@ -74,7 +74,6 @@
 				pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: config.serviceAccountPrivKey})),
 			args.FileOpt("--root-ca-file", "root-ca.pem",
 				pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: config.rootCA})),
-			"--port=0",                               // Kill insecure serving
 			"--use-service-account-credentials=true", // Enables things like PSP enforcement
 			fmt.Sprintf("--cluster-cidr=%v", config.clusterNet.String()),
 			args.FileOpt("--tls-cert-file", "server-cert.pem",
diff --git a/metropolis/node/kubernetes/scheduler.go b/metropolis/node/kubernetes/scheduler.go
index 08ba37f..6007142 100644
--- a/metropolis/node/kubernetes/scheduler.go
+++ b/metropolis/node/kubernetes/scheduler.go
@@ -56,7 +56,6 @@
 		defer args.Close()
 		cmd := exec.CommandContext(ctx, "/kubernetes/bin/kube", "kube-scheduler",
 			args.FileOpt("--kubeconfig", "kubeconfig", config.kubeConfig),
-			"--port=0", // Kill insecure serving
 			args.FileOpt("--tls-cert-file", "server-cert.pem",
 				pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: config.serverCert})),
 			args.FileOpt("--tls-private-key-file", "server-key.pem",