diff --git a/go/cmd/entrypoint/nebula.go b/go/cmd/entrypoint/nebula.go
index d87da86..88e412c 100644
--- a/go/cmd/entrypoint/nebula.go
+++ b/go/cmd/entrypoint/nebula.go
@@ -3,6 +3,7 @@ package main
 import (
 	"fmt"
 	"isle/jsonutil"
+	"isle/nebula"
 	"os"
 )
 
@@ -16,12 +17,20 @@ var subCmdNebulaShow = subCmd{
 			return fmt.Errorf("parsing flags: %w", err)
 		}
 
-		hostBootstrap, err := loadHostBootstrap()
+		hosts, err := subCmdCtx.getHosts()
 		if err != nil {
-			return fmt.Errorf("loading host bootstrap: %w", err)
+			return fmt.Errorf("getting hosts: %w", err)
 		}
 
-		caCert := hostBootstrap.CAPublicCredentials.Cert.Unwrap()
+		var caPublicCreds nebula.CAPublicCredentials
+		err = subCmdCtx.daemonRCPClient.Call(
+			subCmdCtx.ctx, &caPublicCreds, "GetNebulaCAPublicCredentials", nil,
+		)
+		if err != nil {
+			return fmt.Errorf("calling GetNebulaCAPublicCredentials: %w", err)
+		}
+
+		caCert := caPublicCreds.Cert.Unwrap()
 		caCertPEM, err := caCert.MarshalToPEM()
 		if err != nil {
 			return fmt.Errorf("marshaling CA cert to PEM: %w", err)
@@ -50,7 +59,7 @@ var subCmdNebulaShow = subCmd{
 			SubnetCIDR: subnet.String(),
 		}
 
-		for _, h := range hostBootstrap.Hosts {
+		for _, h := range hosts.Hosts {
 			if h.Nebula.PublicAddr == "" {
 				continue
 			}
diff --git a/go/daemon/daemon.go b/go/daemon/daemon.go
index 7a690bf..1bf1139 100644
--- a/go/daemon/daemon.go
+++ b/go/daemon/daemon.go
@@ -49,20 +49,8 @@ type Daemon interface {
 	// - ErrAlreadyJoined
 	JoinNetwork(context.Context, bootstrap.Bootstrap) error
 
-	// GetBootstrapHosts returns the hosts stored in the bootstrap.
-	GetBootstrapHosts(
-		ctx context.Context,
-	) (
-		map[nebula.HostName]bootstrap.Host, error,
-	)
-
-	// GetGarageClientParams returns a GarageClientParams based on the current
-	// network topology.
-	GetGarageClientParams(
-		ctx context.Context,
-	) (
-		bootstrap.GarageClientParams, error,
-	)
+	// GetBootstraps returns the currently active Bootstrap.
+	GetBootstrap(context.Context) (bootstrap.Bootstrap, error)
 
 	// Shutdown blocks until all resources held or created by the daemon,
 	// including child processes it has started, have been cleaned up.
@@ -573,31 +561,13 @@ func (d *daemon) JoinNetwork(
 	}
 }
 
-func (d *daemon) GetBootstrapHosts(
-	ctx context.Context,
-) (
-	map[nebula.HostName]bootstrap.Host, error,
-) {
+func (d *daemon) GetBootstrap(ctx context.Context) (bootstrap.Bootstrap, error) {
 	return withCurrBootstrap(d, func(
 		currBootstrap bootstrap.Bootstrap,
 	) (
-		map[nebula.HostName]bootstrap.Host, error,
+		bootstrap.Bootstrap, error,
 	) {
-		return currBootstrap.Hosts, nil
-	})
-}
-
-func (d *daemon) GetGarageClientParams(
-	ctx context.Context,
-) (
-	bootstrap.GarageClientParams, error,
-) {
-	return withCurrBootstrap(d, func(
-		currBootstrap bootstrap.Bootstrap,
-	) (
-		bootstrap.GarageClientParams, error,
-	) {
-		return currBootstrap.GarageClientParams(), nil
+		return currBootstrap, nil
 	})
 }
 
diff --git a/go/daemon/rpc.go b/go/daemon/rpc.go
index a8dbaa6..886763c 100644
--- a/go/daemon/rpc.go
+++ b/go/daemon/rpc.go
@@ -73,12 +73,12 @@ func (r *RPC) GetHosts(
 ) (
 	GetHostsResult, error,
 ) {
-	hostsMap, err := r.daemon.GetBootstrapHosts(ctx)
+	b, err := r.daemon.GetBootstrap(ctx)
 	if err != nil {
-		return GetHostsResult{}, fmt.Errorf("retrieving hosts: %w", err)
+		return GetHostsResult{}, fmt.Errorf("retrieving bootstrap: %w", err)
 	}
 
-	hosts := maps.Values(hostsMap)
+	hosts := maps.Values(b.Hosts)
 	slices.SortFunc(hosts, func(a, b bootstrap.Host) int {
 		return cmp.Compare(a.Name, b.Name)
 	})
@@ -92,5 +92,27 @@ func (r *RPC) GetGarageClientParams(
 ) (
 	bootstrap.GarageClientParams, error,
 ) {
-	return r.daemon.GetGarageClientParams(ctx)
+	b, err := r.daemon.GetBootstrap(ctx)
+	if err != nil {
+		return bootstrap.GarageClientParams{}, fmt.Errorf(
+			"retrieving bootstrap: %w", err,
+		)
+	}
+
+	return b.GarageClientParams(), nil
+}
+
+func (r *RPC) GetNebulaCAPublicCredentials(
+	ctx context.Context, req struct{},
+) (
+	nebula.CAPublicCredentials, error,
+) {
+	b, err := r.daemon.GetBootstrap(ctx)
+	if err != nil {
+		return nebula.CAPublicCredentials{}, fmt.Errorf(
+			"retrieving bootstrap: %w", err,
+		)
+	}
+
+	return b.CAPublicCredentials, nil
 }