diff --git a/infrastructure/system-upgrades/kubernetes.yaml b/infrastructure/system-upgrades/kubernetes.yaml
index 7041838f504bf434de46ffc35df18e26a6499cb0..14a4465bd6e57fc4ffe7f9ad8e240c809a593f99 100644
--- a/infrastructure/system-upgrades/kubernetes.yaml
+++ b/infrastructure/system-upgrades/kubernetes.yaml
@@ -19,6 +19,13 @@ stringData:
     set -e
     set -x
     systemd-run --same-dir --wait --collect --service-type=exec dnf upgrade -y kubernetes-kubeadm
+  upgrade-crio.sh: |
+    #!/bin/bash
+    set -e
+    set -x
+    secrets="$(dirname "$0")"
+    systemd-run --same-dir --wait --collect --service-type=exec dnf module switch-to --yes cri-o:$(cat $secrets/kubernetes-version)"
+    systemd-run --same-dir --wait --collect --service-type=exec dnf upgrade --yes cri-o
   upgrade-kubernetes.sh: |
     #!/bin/bash
     set -e
@@ -36,6 +43,7 @@ stringData:
     set -x
     secrets="/run/system-upgrade/secrets/kubernetes-upgrade"
     chroot /host sh "$secrets/setup-copr.sh"
+    chroot /host sh "$secrets/upgrade-crio.sh"
     chroot /host sh "$secrets/upgrade-kubeadm.sh"
     if ! /host/usr/bin/kubectl get pods -n kube-system -o yaml | grep "kube-apiserver:$(/host/usr/bin/kubeadm version -o short)"; then
       chroot /host sh "$secrets/upgrade-kubernetes.sh" "first"