diff --git a/pkg/cluster/kubernetes/talos_managed.go b/pkg/cluster/kubernetes/talos_managed.go
index b8c996c61..394f785e7 100644
--- a/pkg/cluster/kubernetes/talos_managed.go
+++ b/pkg/cluster/kubernetes/talos_managed.go
@@ -126,6 +126,8 @@ func upgradeKubeProxy(ctx context.Context, cluster UpgradeProvider, options Upgr
 	options.Log("updating kube-proxy to version %q", options.Path.ToVersion())
 
 	for _, node := range options.controlPlaneNodes {
+		options.Log(" > %q: starting update", node)
+
 		if err := patchNodeConfig(ctx, cluster, node, patchKubeProxy(options)); err != nil {
 			return fmt.Errorf("error updating node %q: %w", node, err)
 		}
@@ -136,6 +138,12 @@ func upgradeKubeProxy(ctx context.Context, cluster UpgradeProvider, options Upgr
 
 func patchKubeProxy(options UpgradeOptions) func(config *v1alpha1config.Config) error {
 	return func(config *v1alpha1config.Config) error {
+		if options.DryRun {
+			options.Log(" > skipped in dry-run")
+
+			return nil
+		}
+
 		if config.ClusterConfig == nil {
 			config.ClusterConfig = &v1alpha1config.ClusterConfig{}
 		}
diff --git a/pkg/kubernetes/kubernetes.go b/pkg/kubernetes/kubernetes.go
index c3449f2c7..cefb78ace 100644
--- a/pkg/kubernetes/kubernetes.go
+++ b/pkg/kubernetes/kubernetes.go
@@ -171,6 +171,7 @@ func (h *Client) NodeIPs(ctx context.Context, machineType machine.Type) (addrs [
 			continue
 		}
 
+		// try to get the internal IP address
 		for _, nodeAddress := range node.Status.Addresses {
 			if nodeAddress.Type == corev1.NodeInternalIP {
 				addrs = append(addrs, nodeAddress.Address)
@@ -178,6 +179,15 @@ func (h *Client) NodeIPs(ctx context.Context, machineType machine.Type) (addrs [
 				break
 			}
 		}
+
+		// no internal IP, fallback to external IP
+		for _, nodeAddress := range node.Status.Addresses {
+			if nodeAddress.Type == corev1.NodeExternalIP {
+				addrs = append(addrs, nodeAddress.Address)
+
+				break
+			}
+		}
 	}
 
 	return addrs, nil