diff --git a/.travis.yml b/.travis.yml
index 69295e5..91594fe 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -9,7 +9,9 @@ env:
     - MOLECULE_DISTRO: centos7
       MOLECULE_DOCKER_COMMAND: /usr/lib/systemd/systemd
     - MOLECULE_DISTRO: ubuntu1604
+      MOLECULE_DOCKER_COMMAND: /lib/systemd/systemd
     - MOLECULE_DISTRO: debian9
+      MOLECULE_DOCKER_COMMAND: /lib/systemd/systemd
 
 install:
   # Install test dependencies.
diff --git a/README.md b/README.md
index 3fe24dd..358eb13 100644
--- a/README.md
+++ b/README.md
@@ -15,6 +15,8 @@ Available variables are listed below, along with default values (see `defaults/m
     kubernetes_packages:
       - name: kubelet
         state: present
+      - name: kubectl
+        state: present
       - name: kubeadm
         state: present
       - name: kubernetes-cni
@@ -22,6 +24,11 @@ Available variables are listed below, along with default values (see `defaults/m
 
 Kubernetes packages to be installed on the server. You can either provide a list of package names, or set `name` and `state` to have more control over whether the package is `present`, `absent`, `latest`, etc.
 
+    kubernetes_version: '1.11'
+    kubernetes_version_rhel_package: '1.11.3'
+
+The minor version of Kubernetes to install. The plain `kubernetes_version` is used to pin an apt package version on Debian, and as the Kubernetes version passed into the `kubeadm init` command (see `kubernetes_version_kubeadm`). The `kubernetes_version_rhel_package` variable must be a specific Kubernetes release, and is used to pin the version on Red Hat / CentOS servers.
+
     kubernetes_role: master
 
 Whether the particular server will serve as a Kubernetes `master` (default) or `node`. The master will have `kubeadm init` run on it to intialize the entire K8s control plane, while `node`s will have `kubeadm join` run on them to join them to the `master`.
@@ -45,7 +52,7 @@ Whether to show extra debug info in Ansible's logs (e.g. the output of the `kube
 
     kubernetes_pod_network_cidr: '10.244.0.0/16'
     kubernetes_apiserver_advertise_address: ''
-    kubernetes_version: 'stable-1.11'
+    kubernetes_version_kubeadm: 'stable-{{ kubernetes_version }}'
     kubernetes_ignore_preflight_errors: 'all'
 
 Options passed to `kubeadm init` when initializing the Kubernetes master. The `apiserver_advertise_address` defaults to `ansible_default_ipv4.address` if it's left empty.
diff --git a/defaults/main.yml b/defaults/main.yml
index 1bc3866..a96d358 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -9,6 +9,9 @@ kubernetes_packages:
   - name: kubernetes-cni
     state: present
 
+kubernetes_version: '1.11'
+kubernetes_version_rhel_package: '1.11.3'
+
 kubernetes_role: master
 
 kubernetes_kubelet_extra_args: ""
@@ -19,7 +22,7 @@ kuberenetes_debug: false
 
 kubernetes_pod_network_cidr: '10.244.0.0/16'
 kubernetes_apiserver_advertise_address: ''
-kubernetes_version: 'stable-1.11'
+kubernetes_version_kubeadm: 'stable-{{ kubernetes_version }}'
 kubernetes_ignore_preflight_errors: 'all'
 
 kubernetes_apt_release_channel: main
diff --git a/molecule/default/molecule.yml b/molecule/default/molecule.yml
index 0339702..ef11d53 100644
--- a/molecule/default/molecule.yml
+++ b/molecule/default/molecule.yml
@@ -11,6 +11,9 @@ platforms:
   - name: instance
     image: geerlingguy/docker-${MOLECULE_DISTRO:-centos7}-ansible
     command: ${MOLECULE_DOCKER_COMMAND:-"sleep infinity"}
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+      - /var/lib/docker
     privileged: true
     pre_build_image: true
 provisioner:
diff --git a/tasks/master-setup.yml b/tasks/master-setup.yml
index 7813dbf..2294ffc 100644
--- a/tasks/master-setup.yml
+++ b/tasks/master-setup.yml
@@ -4,7 +4,7 @@
     kubeadm init
     --pod-network-cidr={{ kubernetes_pod_network_cidr }}
     --apiserver-advertise-address={{ kubernetes_apiserver_advertise_address | default(ansible_default_ipv4.address) }}
-    --kubernetes-version {{ kubernetes_version }}
+    --kubernetes-version {{ kubernetes_version_kubeadm }}
     --ignore-preflight-errors={{ kubernetes_ignore_preflight_errors }}
   register: kubeadmin_init
   failed_when: false
diff --git a/tasks/setup-Debian.yml b/tasks/setup-Debian.yml
index 3b9c72a..1aa5c20 100644
--- a/tasks/setup-Debian.yml
+++ b/tasks/setup-Debian.yml
@@ -18,3 +18,8 @@
     repo: "{{ kubernetes_apt_repository }}"
     state: present
     update_cache: false
+
+- name: Add Kubernetes apt preferences file to pin a version.
+  template:
+    src: apt-preferences-kubernetes.j2
+    dest: /etc/apt/preferences.d/kubernetes
diff --git a/templates/apt-preferences-kubernetes.j2 b/templates/apt-preferences-kubernetes.j2
new file mode 100644
index 0000000..0c7d447
--- /dev/null
+++ b/templates/apt-preferences-kubernetes.j2
@@ -0,0 +1,11 @@
+Package: kubectl
+Pin: version {{ kubernetes_version }}.*
+Pin-Priority: 1000
+
+Package: kubeadm
+Pin: version {{ kubernetes_version }}.*
+Pin-Priority: 1000
+
+Package: kubelet
+Pin: version {{ kubernetes_version }}.*
+Pin-Priority: 1000
diff --git a/vars/RedHat.yml b/vars/RedHat.yml
index 04919de..db8b7ac 100644
--- a/vars/RedHat.yml
+++ b/vars/RedHat.yml
@@ -1,2 +1,11 @@
 ---
 kubelet_environment_file_path: /etc/sysconfig/kubelet
+kubernetes_packages:
+  - name: kubelet-{{ kubernetes_version_rhel_package }}-0
+    state: present
+  - name: kubectl-{{ kubernetes_version_rhel_package }}-0
+    state: present
+  - name: kubeadm-{{ kubernetes_version_rhel_package }}-0
+    state: present
+  - name: kubernetes-cni
+    state: present