diff --git a/e2e/scenario/node_config_test.go b/e2e/scenario/node_config_test.go
index de536f13230..084086da081 100644
--- a/e2e/scenario/node_config_test.go
+++ b/e2e/scenario/node_config_test.go
@@ -92,6 +92,29 @@ func TestKubeletConfigFileExplicitOptOut(t *testing.T) {
 	}
 }
 
+func TestLocalDNSKubeletSettingsPreserveConfigFileParity(t *testing.T) {
+	for _, registered := range List() {
+		if !strings.HasPrefix(registered.Name, "LocalDNS/") &&
+			!strings.HasPrefix(registered.Name, "LocalDNSNoHostsPlugin/") {
+			continue
+		}
+		t.Run(registered.Name, func(t *testing.T) {
+			nbc, err := baseTemplateLinux("eastus", "1.34.0", "amd64")
+			require.NoError(t, err)
+			registered.BootstrapConfigMutator(nil, nbc)
+			cfg, err := nbcToAKSNodeConfigV1(nbc)
+			require.NoError(t, err)
+			require.True(t, cfg.KubeletConfig.EnableKubeletConfigFile)
+			require.NotContains(t, cfg.KubeletConfig.KubeletFlags, "--cluster-dns")
+			registered.AKSNodeConfigMutator(nil, cfg)
+			require.NotContains(t, cfg.KubeletConfig.KubeletFlags, "--cluster-dns",
+				"LocalDNS must not reintroduce a flag translated into the config file")
+			require.Equal(t, []string{localDNSClusterListenerIP},
+				cfg.KubeletConfig.KubeletConfigFileConfig.ClusterDns)
+		})
+	}
+}
+
 func TestLocalDNSForwardsToClusterDNSServiceIP(t *testing.T) {
 	assertCoreDNSForwarding := func(t *testing.T, corefile string) {
 		t.Helper()
diff --git a/e2e/scenario/scenario_localdns_fallback.go b/e2e/scenario/scenario_localdns_fallback.go
index c9366d000d6..7afeb4c4b18 100644
--- a/e2e/scenario/scenario_localdns_fallback.go
+++ b/e2e/scenario/scenario_localdns_fallback.go
@@ -37,10 +37,11 @@ func init() {
 			},
 			AKSNodeConfigMutator: func(_ *Cluster, config *aksnodeconfigv1.Configuration) {
 				config.LocalDnsProfile.EnableLocalDns = true
-				config.KubeletConfig.KubeletFlags["--cluster-dns"] = localDNSClusterListenerIP
-				// See the note in scenario_localdns_hosts.go: the flag alone is not
-				// parity with the CSE path, and the env parity validator fails on it.
-				config.KubeletConfig.KubeletConfigFileConfig.ClusterDns = []string{localDNSClusterListenerIP}
+				if config.KubeletConfig.EnableKubeletConfigFile {
+					config.KubeletConfig.KubeletConfigFileConfig.ClusterDns = []string{localDNSClusterListenerIP}
+				} else {
+					config.KubeletConfig.KubeletFlags["--cluster-dns"] = localDNSClusterListenerIP
+				}
 			},
 			Validator: func(ctx context.Context, s *Scenario) error {
 				return validateLocalDNSCorefileStartupFailure(ctx, s)
diff --git a/e2e/scenario/scenario_localdns_hosts.go b/e2e/scenario/scenario_localdns_hosts.go
index 5e280e3fcaa..e83b5df8336 100644
--- a/e2e/scenario/scenario_localdns_hosts.go
+++ b/e2e/scenario/scenario_localdns_hosts.go
@@ -52,15 +52,11 @@ func init() {
 				AKSNodeConfigMutator: func(_ *Cluster, config *aksnodeconfigv1.Configuration) {
 					config.LocalDnsProfile.EnableHostsPlugin = true
 					config.LocalDnsProfile.EnableLocalDns = true
-					config.KubeletConfig.KubeletFlags["--cluster-dns"] = localDNSClusterListenerIP
-					// The flag alone is not parity with the CSE path. '--cluster-dns' is in
-					// pkg/agent.TranslatedKubeletConfigFlags, so on the CSE path setting the
-					// flag also rewrites KubeletConfiguration.clusterDNS in the kubelet config
-					// file. On the ANC path the flag and the config-file field are independent
-					// proto fields, so the flag alone leaves clusterDNS at the cluster default
-					// and the two paths emit different KUBELET_CONFIG_FILE_CONTENT -- which the
-					// provision-config/nbc-cmd env parity validator fails on.
-					config.KubeletConfig.KubeletConfigFileConfig.ClusterDns = []string{localDNSClusterListenerIP}
+					if config.KubeletConfig.EnableKubeletConfigFile {
+						config.KubeletConfig.KubeletConfigFileConfig.ClusterDns = []string{localDNSClusterListenerIP}
+					} else {
+						config.KubeletConfig.KubeletFlags["--cluster-dns"] = localDNSClusterListenerIP
+					}
 				},
 				VMConfigMutator: tt.vmConfigMutator,
 				Validator: func(ctx context.Context, s *Scenario) error {