diff --git a/lib/cmdlib.py b/lib/cmdlib.py
index 05071be4828c1c42912f8656ee1d2b22a7220fa5..b1f8b8b0270e809b0b729734c11ee6968669e9b9 100644
--- a/lib/cmdlib.py
+++ b/lib/cmdlib.py
@@ -3697,6 +3697,9 @@ def _ComputeAncillaryFiles(cluster, redist):
   if not redist:
     files_all.update(constants.ALL_CERT_FILES)
     files_all.update(ssconf.SimpleStore().GetFileList())
+  else:
+    # we need to ship at least the RAPI certificate
+    files_all.add(constants.RAPI_CERT_FILE)
 
   if cluster.modify_etc_hosts:
     files_all.add(constants.ETC_HOSTS)