diff --git a/infrastructure/system-upgrades/kubernetes.yaml b/infrastructure/system-upgrades/kubernetes.yaml
index f43658515f589dd695e58505653e3ea4d71a2648..c325f770f11e67cd6f59335025a45a4d4e983faa 100644
--- a/infrastructure/system-upgrades/kubernetes.yaml
+++ b/infrastructure/system-upgrades/kubernetes.yaml
@@ -25,11 +25,19 @@ stringData:
     set -e
     set -x
     systemd-run --same-dir --wait --collect --service-type=exec dnf upgrade -y kubernetes-kubeadm
+  crio-pid_limits.conf: |
+    [crio.runtime]
+      pids_limit = 4096
   upgrade-crio.sh: |
     #!/bin/bash
     set -e
     set -x
     secrets="$(dirname "$0")"
+    if ! diff "$secrets/crio-pid_limits.conf" "/etc/crio/crio.conf.d/pid_limits.conf"; then
+      mkdir -p /etc/crio/crio.conf.d/
+      cp "$secrets/crio-pid_limits.conf" "/etc/crio/crio.conf.d/pid_limits.conf"
+      touch /var/run/reboot-required
+    fi
     systemd-run --same-dir --wait --collect --service-type=exec dnf module disable cri-o -y
     systemd-run --same-dir --wait --collect --service-type=exec dnf upgrade -y cri-o
   upgrade-kubernetes.sh: |