diff --git a/DEPENDENCIES b/DEPENDENCIES
index 19d08d1c..67353fe8 100644
--- a/DEPENDENCIES
+++ b/DEPENDENCIES
@@ -1,3 +1,3 @@
 DOCKER_VERSION=17.06
-KUBERNETES_VERSION=1.7.8
-KUBERNETES_CNI_VERSION=0.5.1
+KUBERNETES_VERSION=1.9.2
+KUBERNETES_CNI_VERSION=0.6.0
diff --git a/test/195_no_multicast_route_1_test.sh b/test/195_no_multicast_route_1_test.sh
index b4c1288c..45996920 100755
--- a/test/195_no_multicast_route_1_test.sh
+++ b/test/195_no_multicast_route_1_test.sh
@@ -21,7 +21,7 @@ start_container_local_plugin $HOST1 --name=c3
 
 assert "show_multicast_route_on $HOST1 c1"
 assert "show_multicast_route_on $HOST1 c2"
-assert "show_multicast_route_on $HOST1 c3" "224.0.0.0/4 dev ethwe0 "
+assert "show_multicast_route_on $HOST1 c3" "224.0.0.0/4 dev ethwe0 scope link "
 
 # Now try via docker network options
 # using ssh rather than docker -H because CircleCI docker client is older
@@ -30,7 +30,7 @@ $SSH $HOST1 docker run --net=testmcastfalse --name c4 -di $SMALL_IMAGE /bin/sh
 assert "show_multicast_route_on $HOST1 c4"
 $SSH $HOST1 docker network create --driver weavemesh --ipam-driver weavemesh --opt works.weave.multicast testmcasttrue
 $SSH $HOST1 docker run --net=testmcasttrue --name c5 -di $SMALL_IMAGE /bin/sh
-assert "show_multicast_route_on $HOST1 c5" "224.0.0.0/4 dev ethwe0 "
+assert "show_multicast_route_on $HOST1 c5" "224.0.0.0/4 dev ethwe0 scope link "
 
 # Ensure current proxy options are obeyed on container start
 docker_on $HOST1 stop -t 1 c2
@@ -39,7 +39,7 @@ weave_on $HOST1 launch
 
 proxy docker_on $HOST1 start c2
 
-assert "show_multicast_route_on $HOST1 c2" "224.0.0.0/4 dev ethwe "
+assert "show_multicast_route_on $HOST1 c2" "224.0.0.0/4 dev ethwe scope link "
 
 docker_on $HOST1 rm -f c3 c4 c5
 $SSH $HOST1 docker network rm testmcasttrue testmcastfalse
diff --git a/test/840_weave_kube_3_test.sh b/test/840_weave_kube_3_test.sh
index 89f65a47..48d57d56 100755
--- a/test/840_weave_kube_3_test.sh
+++ b/test/840_weave_kube_3_test.sh
@@ -5,6 +5,10 @@
 tear_down_kubeadm() {
     for host in $HOSTS; do
         run_on $host "sudo kubeadm reset && sudo rm -r -f /opt/cni/bin/*weave*"
+        # Remove the rule to ensure that api-server is not accessible while kube-proxy
+        # is not ready. Otherwise, we have a race between "-j KUBE-FORWARD" and "-j WEAVE-NPC"
+        # which makes the NodePort isolation test case to fail.
+        run_on $host "sudo iptables -t nat -D PREROUTING -m comment --comment \"kubernetes service portals\" -j KUBE-SERVICES" || true
     done
 }
 
@@ -29,16 +33,14 @@ docker_on $HOST1 run --rm --privileged --net=host --entrypoint=/usr/sbin/ipset w
 docker_on $HOST1 run --rm --privileged --net=host --entrypoint=/usr/sbin/ipset weaveworks/weave-npc add test_840_ipset 192.168.1.11
 
 # kubeadm init upgrades to latest Kubernetes version by default, therefore we try to lock the version using the below option:
-#k8s_version="$(run_on $HOST1 "kubelet --version" | grep -oP "(?<=Kubernetes )v[\d\.\-beta]+")"
-# Hack! Override version here as installation via package is broken http://github.com/kubernetes/kubernetes/issues/57334
-k8s_version="v1.8.5"
+k8s_version="$(run_on $HOST1 "kubelet --version" | grep -oP "(?<=Kubernetes )v[\d\.\-beta]+")"
 k8s_version_option="$([[ "$k8s_version" > "v1.6" ]] && echo "kubernetes-version" || echo "use-kubernetes-version")"
 
 for host in $HOSTS; do
     if [ $host = $HOST1 ] ; then
 	run_on $host "sudo systemctl start kubelet && sudo kubeadm init --$k8s_version_option=$k8s_version --token=$TOKEN --pod-network-cidr=$WEAVE_NETWORK"
     else
-	run_on $host "sudo systemctl start kubelet && sudo kubeadm join --token=$TOKEN $HOST1IP:$KUBE_PORT"
+	run_on $host "sudo systemctl start kubelet && sudo kubeadm join --token=$TOKEN --discovery-token-unsafe-skip-ca-verification $HOST1IP:$KUBE_PORT"
     fi
 done
 
diff --git a/test/870_weave_recovers_unreachable_ips_on_relaunch_3_test.sh b/test/870_weave_recovers_unreachable_ips_on_relaunch_3_test.sh
index 19d22592..ea7ba401 100755
--- a/test/870_weave_recovers_unreachable_ips_on_relaunch_3_test.sh
+++ b/test/870_weave_recovers_unreachable_ips_on_relaunch_3_test.sh
@@ -44,7 +44,7 @@ function setup_kubernetes_cluster {
         if [ $host = $HOST1 ] ; then
         run_on $host "sudo systemctl start kubelet && sudo kubeadm init --$k8s_version_option=$k8s_version --token=$TOKEN"
         else
-        run_on $host "sudo systemctl start kubelet && sudo kubeadm join --token=$TOKEN $HOST1IP:$KUBE_PORT"
+        run_on $host "sudo systemctl start kubelet && sudo kubeadm join --token=$TOKEN --discovery-token-unsafe-skip-ca-verification $HOST1IP:$KUBE_PORT"
         fi
     done