diff --git a/cmd/pke/app/phases/pipeline/certificates/certificates.go b/cmd/pke/app/phases/pipeline/certificates/certificates.go
index 61f21192..c2ca83da 100644
--- a/cmd/pke/app/phases/pipeline/certificates/certificates.go
+++ b/cmd/pke/app/phases/pipeline/certificates/certificates.go
@@ -43,6 +43,8 @@ const (
 	kubernetesCAKey         = "/etc/kubernetes/pki/ca.key"
 	frontProxyCACert        = "/etc/kubernetes/pki/front-proxy-ca.crt"
 	frontProxyCAKey         = "/etc/kubernetes/pki/front-proxy-ca.key"
+	saPub                   = "/etc/kubernetes/pki/sa.pub"
+	saKey                   = "/etc/kubernetes/pki/sa.key"
 )
 
 var _ phases.Runnable = (*Certificates)(nil)
@@ -161,6 +163,16 @@ func (c *Certificates) Run(out io.Writer) error {
 		return err
 	}
 
+	// /etc/kubernetes/pki/sa.pub
+	if err = write(out, saPub, secret.Values["saPub"]); err != nil {
+		return err
+	}
+
+	// /etc/kubernetes/pki/sa.key
+	if err = write(out, saKey, secret.Values["saKey"]); err != nil {
+		return err
+	}
+
 	return nil
 }