diff --git a/metropolis/node/core/consensus/status.go b/metropolis/node/core/consensus/status.go
index 55b4339..ee3efbc 100644
--- a/metropolis/node/core/consensus/status.go
+++ b/metropolis/node/core/consensus/status.go
@@ -189,3 +189,21 @@
 	externalAddress string
 	externalPort    int
 }
+
+// RemoveNode removes the etcd member with the given node ID, if it is currently
+// a member. Etcd fails this operation if it is not safe to perform.
+func (s *Status) RemoveNode(ctx context.Context, nodeID string) error {
+	members, err := s.cl.MemberList(ctx)
+	if err != nil {
+		return fmt.Errorf("could not retrieve existing members: %w", err)
+	}
+	for _, m := range members.Members {
+		if GetEtcdMemberNodeId(m) == nodeID {
+			_, err := s.cl.MemberRemove(ctx, m.ID)
+			if err != nil {
+				return fmt.Errorf("could not remove member: %w", err)
+			}
+		}
+	}
+	return nil
+}
diff --git a/metropolis/node/core/curator/impl_leader_management.go b/metropolis/node/core/curator/impl_leader_management.go
index 6315c14..338cc17 100644
--- a/metropolis/node/core/curator/impl_leader_management.go
+++ b/metropolis/node/core/curator/impl_leader_management.go
@@ -354,6 +354,14 @@
 			if node.kubernetesController != nil {
 				return nil, status.Errorf(codes.FailedPrecondition, "could not remove consensus member role while node is a kubernetes controller")
 			}
+			// First, remove the etcd membership. This performs safety checks and
+			// fails if the remaining, currently up nodes would not form a quorum.
+			err := l.consensusStatus.RemoveNode(ctx, id)
+			if err != nil {
+				return nil, status.Errorf(codes.Unavailable, "could not remove node: %v", err)
+			}
+			// After successfully removing membership, it is safe to remove the role,
+			// which will stop etcd running on the node.
 			node.DisableConsensusMember()
 		}
 	}