diff --git a/pkg/plan/bootstrap.go b/pkg/plan/bootstrap.go
index 025596b..d3264c1 100644
--- a/pkg/plan/bootstrap.go
+++ b/pkg/plan/bootstrap.go
@@ -3,9 +3,9 @@ package plan
 import (
 	"context"
 	"fmt"
-	"strings"
 
 	"github.com/rancher/system-agent/pkg/applyinator"
+	"golang.org/x/mod/semver"
 
 	"github.com/rancher/rancherd/pkg/cacerts"
 	"github.com/rancher/rancherd/pkg/config"
@@ -131,17 +131,31 @@ func (p *plan) addInstructions(cfg *config.Config, dataDir string) error {
 		return err
 	}
 
+	// Above Rancher v2.9.x, we cannot patch provisioing cluster with empty rkeConfig,
+	// so we need to delete the webhook validation configuration.
+	if semver.Compare(cfg.RancherVersion, "v2.9.0") >= 0 {
+		if err := p.addInstruction(rancher.ToDeleteRancherWebhookValidationConfiguration(k8sVersion)); err != nil {
+			return err
+		}
+	}
+
 	if err := p.addInstruction(resources.ToInstruction(cfg.RancherInstallerImage, cfg.SystemDefaultRegistry, k8sVersion, dataDir)); err != nil {
 		return err
 	}
 
-	// currently instruction is only needed for v2.8.x
-	if strings.HasPrefix(cfg.RancherVersion, "v2.8") {
+	// currently instruction is needed for version above v2.8.x
+	if semver.Compare(cfg.RancherVersion, "v2.8.0") >= 0 {
 		if err := p.addInstruction(rancher.PatchLocalProvisioningClusterStatus(cfg.RancherInstallerImage, cfg.SystemDefaultRegistry, k8sVersion)); err != nil {
 			return err
 		}
 	}
 
+	if semver.Compare(cfg.RancherVersion, "v2.9.0") >= 0 {
+		if err := p.addInstruction(rancher.ToRestartRancherWebhookInstruction(k8sVersion)); err != nil {
+			return err
+		}
+	}
+
 	if err := p.addInstruction(rancher.ToWaitSUCInstruction(cfg.RancherInstallerImage, cfg.SystemDefaultRegistry, k8sVersion)); err != nil {
 		return err
 	}
diff --git a/pkg/rancher/wait.go b/pkg/rancher/wait.go
index a2246ad..7261a93 100644
--- a/pkg/rancher/wait.go
+++ b/pkg/rancher/wait.go
@@ -124,6 +124,34 @@ func ToScaleUpFleetControllerInstruction(_, _, k8sVersion string) (*applyinator.
 	}, nil
 }
 
+func ToDeleteRancherWebhookValidationConfiguration(k8sVersion string) (*applyinator.Instruction, error) {
+	cmd, err := self.Self()
+	if err != nil {
+		return nil, fmt.Errorf("resolving location of %s: %w", os.Args[0], err)
+	}
+	return &applyinator.Instruction{
+		Name:       "delete-rancher-webhook-validation-configuration",
+		SaveOutput: true,
+		Args:       []string{"retry", kubectl.Command(k8sVersion), "delete", "validatingwebhookconfiguration", "rancher.cattle.io"},
+		Env:        kubectl.Env(k8sVersion),
+		Command:    cmd,
+	}, nil
+}
+
+func ToRestartRancherWebhookInstruction(k8sVersion string) (*applyinator.Instruction, error) {
+	cmd, err := self.Self()
+	if err != nil {
+		return nil, fmt.Errorf("resolving location of %s: %w", os.Args[0], err)
+	}
+	return &applyinator.Instruction{
+		Name:       "wait-rancher-webhook",
+		SaveOutput: true,
+		Args:       []string{"retry", kubectl.Command(k8sVersion), "-n", "cattle-system", "rollout", "restart", "deploy/rancher-webhook"},
+		Env:        kubectl.Env(k8sVersion),
+		Command:    cmd,
+	}, nil
+}
+
 // Needs to patch status subresource
 // k patch cluster.provisioning local -n fleet-local --subresource=status --type=merge --patch '{"status":{"fleetWorkspaceName": "fleet-local"}}'
 func PatchLocalProvisioningClusterStatus(_, _, k8sVersion string) (*applyinator.Instruction, error) {
@@ -132,7 +160,7 @@ func PatchLocalProvisioningClusterStatus(_, _, k8sVersion string) (*applyinator.
 		return nil, fmt.Errorf("resolving location of %s: %w", os.Args[0], err)
 	}
 	return &applyinator.Instruction{
-		Name:       "wait-suc-plan-resolved",
+		Name:       "patch-provisioning-cluster-status",
 		SaveOutput: true,
 		Args:       []string{"retry", kubectl.Command(k8sVersion), "-n", "fleet-local", "patch", "cluster.provisioning", "local", "--subresource=status", "--type=merge", "--patch", "{\"status\":{\"fleetWorkspaceName\": \"fleet-local\"}}"},
 		Env:        kubectl.Env(k8sVersion),
diff --git a/pkg/resources/resources.go b/pkg/resources/resources.go
index 1800223..9faf48d 100644
--- a/pkg/resources/resources.go
+++ b/pkg/resources/resources.go
@@ -107,9 +107,8 @@ func ToBootstrapFile(config *config.Config, path string) (*applyinator.File, err
 			},
 			"spec": map[string]interface{}{
 				"kubernetesVersion": k8sVersion,
-				"rkeConfig": map[string]interface{}{
-					"controlPlaneConfig": config.ConfigValues,
-				},
+				// Rancher needs a non-null rkeConfig to apply system-upgrade-controller managed chart.
+				"rkeConfig": map[string]interface{}{},
 			},
 		},
 	}, v1.GenericMap{