diff --git a/apps/cluster-infrastructure/system-upgrade-plans.yaml b/apps/cluster-infrastructure/system-upgrade-plans.yaml
new file mode 100644
index 0000000..0abbb7c
--- /dev/null
+++ b/apps/cluster-infrastructure/system-upgrade-plans.yaml
@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: system-upgrade-plans
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "20"
+spec:
+  project: cluster-infrastructure
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+  source:
+    path: manifests/system-upgrade/
+    repoURL: https://github.com/vojtechmares/cthulhunetes-gitops.git
+    targetRevision: HEAD
+  destination:
+    server: "https://kubernetes.default.svc"
+    namespace: system-upgrade
diff --git a/manifests/system-upgrade/k3s-upgrade-v1.28.yaml b/manifests/system-upgrade/k3s-upgrade-v1.28.yaml
new file mode 100644
index 0000000..b62580c
--- /dev/null
+++ b/manifests/system-upgrade/k3s-upgrade-v1.28.yaml
@@ -0,0 +1,26 @@
+# Cluster has only k3s-server nodes, no need for k3s-agent plan
+apiVersion: upgrade.cattle.io/v1
+kind: Plan
+metadata:
+  name: k3s-server-v1.28
+  namespace: system-upgrade
+  labels:
+    k3s-upgrade: server
+spec:
+  concurrency: 1 # Batch size (roughly maps to maximum number of unschedulable nodes)
+  channel: https://update.k3s.io/v1-release/channels/v1.28
+  nodeSelector:
+    matchExpressions:
+      - {key: k3s-upgrade, operator: Exists}
+      - {key: k3s-upgrade, operator: NotIn, values: ["disabled", "false"]}
+      - {key: k3os.io/mode, operator: DoesNotExist}
+      - {key: node-role.kubernetes.io/control-plane, operator: Exists}
+  serviceAccountName: system-upgrade
+  cordon: true
+  drain:
+    force: false
+    ignoreDaemonSets: true
+    deleteLocalData: true
+    skipWaitForDeleteTimeout: 180
+  upgrade:
+    image: rancher/k3s-upgrade