diff --git a/Makefile b/Makefile
index da288b576..b057d9e67 100644
--- a/Makefile
+++ b/Makefile
@@ -788,3 +788,9 @@ tilt-up: env-vars-for-wl-cluster $(ENVSUBST) $(KUBECTL) $(KUSTOMIZE) $(TILT) clu
 .PHONY: watch
 watch: ## Watch CRDs cluster, machines and Events.
 	watch -c -n 2 hack/output-for-watch.sh
+
+installimageurl := $(shell curl -sL https://api.github.com/repos/syself/hetzner-installimage/releases/latest | jq -r .assets[].browser_download_url)
+.PHONY: create-hetzner-installimage-tgz
+create-hetzner-installimage-tgz:
+	rm -rf data/hetzner-installimage*
+	cd data; curl -sSLO $(installimageurl)
diff --git a/Tiltfile b/Tiltfile
index a80c45b33..b8d75e674 100644
--- a/Tiltfile
+++ b/Tiltfile
@@ -137,6 +137,9 @@ def set_env_variables():
 tilt_dockerfile_header = """
 FROM gcr.io/distroless/base:debug as tilt
 WORKDIR /
+
+COPY installimage.tgz .
+
 COPY manager .
 """
 
@@ -154,6 +157,10 @@ def caph():
             yaml = str(encode_yaml_stream(yaml_dict))
             yaml = fixup_yaml_empty_arrays(yaml)
 
+    # copy things from data directory to .tiltbuild 
+    if not os.path.exists('.tiltbuild/hetzner-installimage.tgz'):
+        local("cp data/hetzner-install-image-v1.0.0.tgz .tiltbuild/installimage.tgz")
+
     # Set up a local_resource build of the provider's manager binary.
 
     # Forge the build command
@@ -183,7 +190,7 @@ def caph():
         dockerfile_contents = tilt_dockerfile_header,
         target = "tilt",
         entrypoint = entrypoint,
-        only = "manager",
+        only = ["manager", "installimage.tgz"],
         live_update = [
             sync(".tiltbuild/manager", "/manager"),
         ],
diff --git a/controllers/hetznerbaremetalhost_controller_test.go b/controllers/hetznerbaremetalhost_controller_test.go
index 3c5db670c..927d3543c 100644
--- a/controllers/hetznerbaremetalhost_controller_test.go
+++ b/controllers/hetznerbaremetalhost_controller_test.go
@@ -829,6 +829,7 @@ name="eth0" model="Realtek Semiconductor Co., Ltd. RTL8111/8168/8411 PCI Express
 	})
 	sshClient.On("DownloadImage", mock.Anything, mock.Anything).Return(sshclient.Output{})
 	sshClient.On("CreateAutoSetup", mock.Anything).Return(sshclient.Output{})
+	sshClient.On("UntarTGZ").Return(sshclient.Output{})
 	sshClient.On("CreatePostInstallScript", mock.Anything).Return(sshclient.Output{})
 	sshClient.On("ExecuteInstallImage", mock.Anything).Return(sshclient.Output{})
 	sshClient.On("Reboot").Return(sshclient.Output{})
diff --git a/controllers/hetznerbaremetalremediation_controller_test.go b/controllers/hetznerbaremetalremediation_controller_test.go
index 4a63905e4..8a3d4553a 100644
--- a/controllers/hetznerbaremetalremediation_controller_test.go
+++ b/controllers/hetznerbaremetalremediation_controller_test.go
@@ -213,6 +213,7 @@ var _ = Describe("HetznerBareMetalRemediationReconciler", func() {
 		osSSHClientAfterInstallImage.On("CloudInitStatus").Return(sshclient.Output{StdOut: "status: done"})
 		osSSHClientAfterInstallImage.On("CheckCloudInitLogsForSigTerm").Return(sshclient.Output{})
 		osSSHClientAfterInstallImage.On("ResetKubeadm").Return(sshclient.Output{})
+		osSSHClientAfterInstallImage.On("GetCloudInitOutput").Return(sshclient.Output{StdOut: "dummy content of /var/log/cloud-init-output.log"})
 		osSSHClientAfterInstallImage.On("GetHostName").Return(sshclient.Output{
 			StdOut: infrav1.BareMetalHostNamePrefix + bmMachineName,
 			StdErr: "",
@@ -227,6 +228,7 @@ var _ = Describe("HetznerBareMetalRemediationReconciler", func() {
 		osSSHClientAfterCloudInit.On("CloudInitStatus").Return(sshclient.Output{StdOut: "status: done"})
 		osSSHClientAfterCloudInit.On("CheckCloudInitLogsForSigTerm").Return(sshclient.Output{})
 		osSSHClientAfterCloudInit.On("ResetKubeadm").Return(sshclient.Output{})
+		osSSHClientAfterCloudInit.On("GetCloudInitOutput").Return(sshclient.Output{StdOut: "dummy content of /var/log/cloud-init-output.log"})
 	})
 
 	AfterEach(func() {
diff --git a/data/hetzner-install-image-v1.0.0.tgz b/data/hetzner-install-image-v1.0.0.tgz
new file mode 100644
index 000000000..5b3d0dde1
Binary files /dev/null and b/data/hetzner-install-image-v1.0.0.tgz differ
diff --git a/hack/filter-caph-controller-manager-logs.py b/hack/filter-caph-controller-manager-logs.py
index ba17869e5..23aa1e789 100755
--- a/hack/filter-caph-controller-manager-logs.py
+++ b/hack/filter-caph-controller-manager-logs.py
@@ -22,7 +22,7 @@
 
 keys_to_skip = ['controller', 'controllerGroup', 'controllerKind', 'reconcileID',
                 'HetznerCluster', 'Cluster',
-                'namespace', 'name', 'Machine']
+                'namespace', 'name', 'Machine', 'stack', 'stacktrace']
 
 rows_to_skip = [
     'controller-runtime.webhook', 'certwatcher/certwatcher', 'Registering a validating webhook',
diff --git a/hack/kind-dev.sh b/hack/kind-dev.sh
index de997b256..22ea2952c 100755
--- a/hack/kind-dev.sh
+++ b/hack/kind-dev.sh
@@ -32,7 +32,7 @@ local CLUSTER_VERSION=$2
 cat <<EOF | ctlptl apply -f -
 apiVersion: ctlptl.dev/v1alpha1
 kind: Registry
-name: ${CLUSTER_NAME}-registry
+name: kind-registry
 port: 5000
 ---
 apiVersion: ctlptl.dev/v1alpha1
diff --git a/hack/output-for-watch.sh b/hack/output-for-watch.sh
index 0d74a79c6..df6976e87 100755
--- a/hack/output-for-watch.sh
+++ b/hack/output-for-watch.sh
@@ -38,7 +38,7 @@ kubectl get hetznerbaremetalmachine -A
 
 print_heading events:
 
-kubectl get events -A --sort-by=lastTimestamp | tail -8
+kubectl get events -A --sort-by=lastTimestamp | grep -vP 'LeaderElection' | tail -8
 
 print_heading logs:
 
diff --git a/images/caph/Dockerfile b/images/caph/Dockerfile
index c890858f9..3bebaf54d 100644
--- a/images/caph/Dockerfile
+++ b/images/caph/Dockerfile
@@ -25,6 +25,7 @@ RUN --mount=type=cache,target=/root/.cache --mount=type=cache,target=/go/pkg \
 
 FROM --platform=${BUILDPLATFORM} gcr.io/distroless/static:nonroot
 WORKDIR /
+COPY data/hetzner-install-image-v1.0.0.tgz /installimage.tgz
 COPY --from=build /src/cluster-api-provider-hetzner/manager .
 # Use uid of nonroot user (65532) because kubernetes expects numeric user when applying pod security policies
 USER 65532
diff --git a/pkg/services/baremetal/client/mocks/ssh/Client.go b/pkg/services/baremetal/client/mocks/ssh/Client.go
index fc25239d5..0f170250e 100644
--- a/pkg/services/baremetal/client/mocks/ssh/Client.go
+++ b/pkg/services/baremetal/client/mocks/ssh/Client.go
@@ -1052,6 +1052,47 @@ func (_c *Client_ResetKubeadm_Call) RunAndReturn(run func() sshclient.Output) *C
 	return _c
 }
 
+// UntarTGZ provides a mock function with given fields:
+func (_m *Client) UntarTGZ() sshclient.Output {
+	ret := _m.Called()
+
+	var r0 sshclient.Output
+	if rf, ok := ret.Get(0).(func() sshclient.Output); ok {
+		r0 = rf()
+	} else {
+		r0 = ret.Get(0).(sshclient.Output)
+	}
+
+	return r0
+}
+
+// Client_UntarTGZ_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'UntarTGZ'
+type Client_UntarTGZ_Call struct {
+	*mock.Call
+}
+
+// UntarTGZ is a helper method to define mock.On call
+func (_e *Client_Expecter) UntarTGZ() *Client_UntarTGZ_Call {
+	return &Client_UntarTGZ_Call{Call: _e.mock.On("UntarTGZ")}
+}
+
+func (_c *Client_UntarTGZ_Call) Run(run func()) *Client_UntarTGZ_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
+	return _c
+}
+
+func (_c *Client_UntarTGZ_Call) Return(_a0 sshclient.Output) *Client_UntarTGZ_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *Client_UntarTGZ_Call) RunAndReturn(run func() sshclient.Output) *Client_UntarTGZ_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
 // NewClient creates a new instance of Client. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
 // The first argument is typically a *testing.T value.
 func NewClient(t interface {
diff --git a/pkg/services/baremetal/client/ssh/ssh_client.go b/pkg/services/baremetal/client/ssh/ssh_client.go
index c79a6af57..a833d5b83 100644
--- a/pkg/services/baremetal/client/ssh/ssh_client.go
+++ b/pkg/services/baremetal/client/ssh/ssh_client.go
@@ -20,8 +20,10 @@ package sshclient
 import (
 	"bufio"
 	"bytes"
+	"encoding/base64"
 	"errors"
 	"fmt"
+	"os"
 	"regexp"
 	"strings"
 	"time"
@@ -92,6 +94,7 @@ type Client interface {
 	CleanCloudInitLogs() Output
 	CleanCloudInitInstances() Output
 	ResetKubeadm() Output
+	UntarTGZ() Output
 }
 
 // Factory is the interface for creating new Client objects.
@@ -236,9 +239,9 @@ func (c *sshClient) CreatePostInstallScript(data string) Output {
 func (c *sshClient) ExecuteInstallImage(hasPostInstallScript bool) Output {
 	var cmd string
 	if hasPostInstallScript {
-		cmd = `/root/.oldroot/nfs/install/installimage -a -c /autosetup -x /root/post-install.sh`
+		cmd = `/root/hetzner-installimage/installimage -a -c /autosetup -x /root/post-install.sh`
 	} else {
-		cmd = `/root/.oldroot/nfs/install/installimage -a -c /autosetup`
+		cmd = `/root/hetzner-installimage/installimage -a -c /autosetup`
 	}
 
 	out := c.runSSH(fmt.Sprintf(`cat << 'EOF' > /root/install-image-script.sh
@@ -365,6 +368,17 @@ func (c *sshClient) ResetKubeadm() Output {
 	return output
 }
 
+func (c *sshClient) UntarTGZ() Output {
+	fileName := "/installimage.tgz"
+	data, err := os.ReadFile(fileName)
+	if err != nil {
+		return Output{Err: fmt.Errorf("ReadInstallimageTgzFailed %s: %w", fileName, err)}
+	}
+
+	return c.runSSH(fmt.Sprintf("echo %s | base64 -d | tar -xzf-",
+		base64.StdEncoding.EncodeToString(data)))
+}
+
 // IsConnectionRefusedError checks whether the ssh error is a connection refused error.
 func IsConnectionRefusedError(err error) bool {
 	return strings.Contains(err.Error(), ErrConnectionRefused.Error())
diff --git a/pkg/services/baremetal/host/host.go b/pkg/services/baremetal/host/host.go
index fb55c19ec..7b896f8e0 100644
--- a/pkg/services/baremetal/host/host.go
+++ b/pkg/services/baremetal/host/host.go
@@ -950,8 +950,14 @@ func (s *Service) actionImageInstalling() actionResult {
 		}
 	}
 
+	out := sshClient.UntarTGZ()
+	if out.Err != nil {
+		record.Warnf(s.scope.HetznerBareMetalHost, "UntarInstallimageTgzFailed", "err: %s, stderr: %s", out.Err.Error(), out.StdErr)
+		return actionError{err: fmt.Errorf("UntarInstallimageTgzFailed: %w", out.Err)}
+	}
+
 	// Execute install image
-	out := sshClient.ExecuteInstallImage(postInstallScript != "")
+	out = sshClient.ExecuteInstallImage(postInstallScript != "")
 	if out.Err != nil {
 		record.Warnf(s.scope.HetznerBareMetalHost, "ExecuteInstallImageFailed", out.StdOut)
 		return actionError{err: fmt.Errorf("failed to execute installimage: %w", out.Err)}