diff --git a/roles/kubernetes-apps/ansible/templates/dns-autoscaler.yml.j2 b/roles/kubernetes-apps/ansible/templates/dns-autoscaler.yml.j2
index df9bd3623..9cacf6079 100644
--- a/roles/kubernetes-apps/ansible/templates/dns-autoscaler.yml.j2
+++ b/roles/kubernetes-apps/ansible/templates/dns-autoscaler.yml.j2
@@ -46,6 +46,8 @@ spec:
         - effect: NoSchedule
           operator: Equal
           key: node-role.kubernetes.io/master
+        - key: "CriticalAddonsOnly"
+          operator: "Exists"
       affinity:
         podAntiAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
@@ -77,7 +79,4 @@ spec:
         - --v=2
         - --configmap=dns-autoscaler{{ coredns_ordinal_suffix }}
         - --target=Deployment/coredns{{ coredns_ordinal_suffix }}
-      tolerations:
-      - key: "CriticalAddonsOnly"
-        operator: "Exists"
       serviceAccountName: dns-autoscaler