diff --git a/nodeup/pkg/model/crictl.go b/nodeup/pkg/model/crictl.go
new file mode 100644
index 0000000000..1221698625
--- /dev/null
+++ b/nodeup/pkg/model/crictl.go
@@ -0,0 +1,48 @@
+package model
+
+import (
+	"fmt"
+
+	"k8s.io/kops/upup/pkg/fi"
+	"k8s.io/kops/upup/pkg/fi/nodeup/nodetasks"
+	"k8s.io/kops/util/pkg/distributions"
+)
+
+type CrictlBuilder struct {
+	*NodeupModelContext
+}
+
+var _ fi.NodeupModelBuilder = &CrictlBuilder{}
+
+func (b *CrictlBuilder) Build(c *fi.NodeupModelBuilderContext) error {
+	assetName := "crictl"
+	assetPath := ""
+	asset, err := b.Assets.Find(assetName, assetPath)
+	if err != nil {
+		return fmt.Errorf("unable to locate asset %q", err)
+	}
+
+	c.AddTask(&nodetasks.File{
+		Path:     b.crictlPath(),
+		Contents: asset,
+		Type:     nodetasks.FileType_File,
+		Mode:     s("0755"),
+	})
+
+	return nil
+}
+
+func (b *CrictlBuilder) binaryPath() string {
+	path := "/usr/local/bin"
+	if b.Distribution == distributions.DistributionFlatcar {
+		path = "/opt/kops/bin"
+	}
+	if b.Distribution == distributions.DistributionContainerOS {
+		path = "/home/kubernetes/bin"
+	}
+	return path
+}
+
+func (b *CrictlBuilder) crictlPath() string {
+	return b.binaryPath() + "/crictl"
+}
diff --git a/upup/pkg/fi/cloudup/apply_cluster.go b/upup/pkg/fi/cloudup/apply_cluster.go
index 43403eef16..04e19ece7b 100644
--- a/upup/pkg/fi/cloudup/apply_cluster.go
+++ b/upup/pkg/fi/cloudup/apply_cluster.go
@@ -1154,6 +1154,14 @@ func (c *ApplyClusterCmd) addFileAssets(assetBuilder *assets.AssetBuilder) error
 			}
 		}
 
+		crictlAssetUrl, crictlAssetHash, err := findCrictlAsset(c.Cluster, assetBuilder, arch)
+		if err != nil {
+			return err
+		}
+		if crictlAssetUrl != nil && crictlAssetHash != nil {
+			c.Assets[arch] = append(c.Assets[arch], mirrors.BuildMirroredAsset(crictlAssetUrl, crictlAssetHash))
+		}
+
 		asset, err := NodeUpAsset(assetBuilder, arch)
 		if err != nil {
 			return err
diff --git a/upup/pkg/fi/cloudup/crictl.go b/upup/pkg/fi/cloudup/crictl.go
new file mode 100644
index 0000000000..09011bbdd9
--- /dev/null
+++ b/upup/pkg/fi/cloudup/crictl.go
@@ -0,0 +1,40 @@
+package cloudup
+
+import (
+	"fmt"
+	"net/url"
+
+	"k8s.io/kops/pkg/apis/kops"
+	"k8s.io/kops/pkg/assets"
+	"k8s.io/kops/util/pkg/architectures"
+	"k8s.io/kops/util/pkg/hashing"
+)
+
+const (
+	crictlAssetUrlAmd64 = "https://github.com/kubernetes-sigs/cri-tools/releases/download/v1.29.0/crictl-v1.29.0-linux-amd64.tar.gz"
+	crictlAssetUrlArm64 = "https://github.com/kubernetes-sigs/cri-tools/releases/download/v1.29.0/crictl-v1.29.0-linux-arm64.tar.gz"
+)
+
+func findCrictlAsset(c *kops.Cluster, assetBuilder *assets.AssetBuilder, arch architectures.Architecture) (*url.URL, *hashing.Hash, error) {
+	var assetURL string
+	switch arch {
+	case architectures.ArchitectureAmd64:
+		assetURL = crictlAssetUrlAmd64
+	case architectures.ArchitectureArm64:
+		assetURL = crictlAssetUrlArm64
+	default:
+		return nil, nil, fmt.Errorf("unknown arch for crictl binaries asset: %s", arch)
+	}
+
+	u, err := url.Parse(assetURL)
+	if err != nil {
+		return nil, nil, fmt.Errorf("unable to parse crictl binaries asset URL %q: %v", assetURL, err)
+	}
+
+	u, h, err := assetBuilder.RemapFileAndSHA(u)
+	if err != nil {
+		return nil, nil, fmt.Errorf("unable to remap crictl binaries asset: %v", err)
+	}
+
+	return u, h, err
+}
diff --git a/upup/pkg/fi/nodeup/command.go b/upup/pkg/fi/nodeup/command.go
index 33b433e377..4a98c7c86c 100644
--- a/upup/pkg/fi/nodeup/command.go
+++ b/upup/pkg/fi/nodeup/command.go
@@ -315,6 +315,7 @@ func (c *NodeUpCommand) Run(out io.Writer) error {
 	loader.Builders = append(loader.Builders, &model.WarmPoolBuilder{NodeupModelContext: modelContext})
 	loader.Builders = append(loader.Builders, &model.PrefixBuilder{NodeupModelContext: modelContext})
 	loader.Builders = append(loader.Builders, &model.NerdctlBuilder{NodeupModelContext: modelContext})
+	loader.Builders = append(loader.Builders, &model.CrictlBuilder{NodeupModelContext: modelContext})
 
 	loader.Builders = append(loader.Builders, &networking.CommonBuilder{NodeupModelContext: modelContext})
 	loader.Builders = append(loader.Builders, &networking.CalicoBuilder{NodeupModelContext: modelContext})