diff --git a/charts/yurt-manager/templates/yurt-manager-auto-generated.yaml b/charts/yurt-manager/templates/yurt-manager-auto-generated.yaml
index d5be3bad7bb..c8242fdf2cc 100644
--- a/charts/yurt-manager/templates/yurt-manager-auto-generated.yaml
+++ b/charts/yurt-manager/templates/yurt-manager-auto-generated.yaml
@@ -67,6 +67,7 @@ rules:
   resources:
   - customresourcedefinitions
   verbs:
+  - create
   - get
   - list
   - patch
diff --git a/charts/yurt-manager/templates/yurt-manager.yaml b/charts/yurt-manager/templates/yurt-manager.yaml
index 9f72f3b1551..1bda1551dd9 100644
--- a/charts/yurt-manager/templates/yurt-manager.yaml
+++ b/charts/yurt-manager/templates/yurt-manager.yaml
@@ -85,6 +85,10 @@ spec:
           key: node-role.kubernetes.io/master
         - effect: NoSchedule
           key: node-role.kubernetes.io/control-plane
+      initContainers:
+        - image: {{ .Values.initImage.registry }}/{{ .Values.initImage.repository }}:{{ .Values.initImage.tag }}
+          name: crd-upgrader
+          imagePullPolicy: IfNotPresent
       containers:
         - args:
             - --metrics-addr=:{{ .Values.ports.metrics }}
diff --git a/charts/yurt-manager/values.yaml b/charts/yurt-manager/values.yaml
index dbeb81f5b6d..1bae5b659eb 100644
--- a/charts/yurt-manager/values.yaml
+++ b/charts/yurt-manager/values.yaml
@@ -18,6 +18,14 @@ image:
   # pullSecrets:
   #   - name: myRegistryKeySecretName
 
+initImage:
+  registry: openyurt
+  repository: crd-upgrader
+  tag: v1.4.0
+  pullSecrets: []
+  # pullSecrets:
+  #   - name: myRegistryKeySecretName
+
 ports:
   metrics: 10271
   healthProbe: 10272
diff --git a/hack/boilerplate.go.txt b/hack/boilerplate.go.txt
index 756a0eb0d97..e6e353c6948 100644
--- a/hack/boilerplate.go.txt
+++ b/hack/boilerplate.go.txt
@@ -1,5 +1,5 @@
 /*
-Copyright 2023 The OpenYurt Authors.
+Copyright 2024 The OpenYurt Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
diff --git a/hack/dockerfiles/build/Dockerfile.crd-upgrader b/hack/dockerfiles/build/Dockerfile.crd-upgrader
new file mode 100644
index 00000000000..0781a838597
--- /dev/null
+++ b/hack/dockerfiles/build/Dockerfile.crd-upgrader
@@ -0,0 +1,11 @@
+FROM bitnami/kubectl:1.29
+
+# Add the CRD installation script to the container
+COPY ./hack/make-rules/crd_upgrader.sh /usr/local/bin/crd-upgrade.sh
+
+# Add CRD YAML files to the container
+COPY ./charts/yurt-manager/crds /crds
+COPY ./charts/yurt-iot-dock/crds /crds
+
+# Set the entrypoint to the CRD installation script
+ENTRYPOINT ["/usr/local/bin/crd-upgrade.sh"]
diff --git a/hack/dockerfiles/release/Dockerfile.crd-upgrader b/hack/dockerfiles/release/Dockerfile.crd-upgrader
new file mode 100644
index 00000000000..0781a838597
--- /dev/null
+++ b/hack/dockerfiles/release/Dockerfile.crd-upgrader
@@ -0,0 +1,11 @@
+FROM bitnami/kubectl:1.29
+
+# Add the CRD installation script to the container
+COPY ./hack/make-rules/crd_upgrader.sh /usr/local/bin/crd-upgrade.sh
+
+# Add CRD YAML files to the container
+COPY ./charts/yurt-manager/crds /crds
+COPY ./charts/yurt-iot-dock/crds /crds
+
+# Set the entrypoint to the CRD installation script
+ENTRYPOINT ["/usr/local/bin/crd-upgrade.sh"]
diff --git a/hack/make-rules/crd_upgrader.sh b/hack/make-rules/crd_upgrader.sh
new file mode 100755
index 00000000000..b85faa1bad0
--- /dev/null
+++ b/hack/make-rules/crd_upgrader.sh
@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+
+# Copyright 2024 The OpenYurt Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -x
+set -e
+
+CRD_DIR="/crds"
+
+for crd in "$CRD_DIR"/*.yaml; do
+    echo "Applying CRD: $crd"
+    kubectl apply --server-side -f "$crd"
+done
+
+echo "CRDs successfully applied."
\ No newline at end of file
diff --git a/hack/make-rules/image_build.sh b/hack/make-rules/image_build.sh
index 8a7e9540eaa..7168c02a91c 100755
--- a/hack/make-rules/image_build.sh
+++ b/hack/make-rules/image_build.sh
@@ -28,9 +28,14 @@ readonly IMAGE_TARGETS=(
     yurt-iot-dock
 )
 
+readonly INIT_IMAGE_TARGETS=(
+    crd-upgrader
+)
+
 http_proxy=${http_proxy:-}
 https_proxy=${https_proxy:-}
 targets=${@:-${IMAGE_TARGETS[@]}}
+init_targets=${@:-${INIT_IMAGE_TARGETS[@]}}
 REGION=${REGION:-}
 IMAGE_REPO=${IMAGE_REPO:-"openyurt"}
 IMAGE_TAG=${IMAGE_TAG:-$(get_image_tag)}
@@ -98,3 +103,13 @@ for image in ${targets[@]}; do
     --tag ${IMAGE_REPO}/${image}:${IMAGE_TAG} \
     ${YURT_ROOT}
 done
+
+for image in ${init_targets[@]}; do
+    docker buildx build \
+    --no-cache \
+    --load ${DOCKER_BUILD_ARGS} \
+    --platform ${TARGET_PLATFORMS} \
+    --file ${YURT_ROOT}/hack/dockerfiles/build/Dockerfile.${image} \
+    --tag ${IMAGE_REPO}/${image}:${IMAGE_TAG} \
+    ${YURT_ROOT}
+done
\ No newline at end of file
diff --git a/pkg/yurtmanager/webhook/server.go b/pkg/yurtmanager/webhook/server.go
index be6b725ef9f..914a610d924 100644
--- a/pkg/yurtmanager/webhook/server.go
+++ b/pkg/yurtmanager/webhook/server.go
@@ -143,7 +143,7 @@ type GateFunc func() (enabled bool)
 // +kubebuilder:rbac:groups=core,namespace=kube-system,resources=secrets,verbs=get;update
 // +kubebuilder:rbac:groups=admissionregistration.k8s.io,resources=mutatingwebhookconfigurations,verbs=get;list;watch;update;patch
 // +kubebuilder:rbac:groups=admissionregistration.k8s.io,resources=validatingwebhookconfigurations,verbs=get;list;watch;update;patch
-// +kubebuilder:rbac:groups=apiextensions.k8s.io,resources=customresourcedefinitions,verbs=get;list;watch;update;patch
+// +kubebuilder:rbac:groups=apiextensions.k8s.io,resources=customresourcedefinitions,verbs=get;list;watch;update;patch;create
 
 func Initialize(ctx context.Context, cc *config.CompletedConfig, restCfg *rest.Config) error {
 	c, err := webhookcontroller.New(WebhookHandlerPath, cc, restCfg)
diff --git a/test/e2e/cmd/init/converter.go b/test/e2e/cmd/init/converter.go
index 4dbafcb8fa2..63058aec85e 100644
--- a/test/e2e/cmd/init/converter.go
+++ b/test/e2e/cmd/init/converter.go
@@ -212,7 +212,7 @@ func (c *ClusterConverter) installYurtManagerByHelm() error {
 	imageTagParts := strings.Split(parts[len(parts)-1], ":")
 	tag := imageTagParts[1]
 
-	cmd := exec.Command(helmPath, "install", "yurt-manager", yurtManagerChartPath, "--namespace", "kube-system", "--set", fmt.Sprintf("image.tag=%s", tag))
+	cmd := exec.Command(helmPath, "install", "yurt-manager", yurtManagerChartPath, "--namespace", "kube-system", "--set", fmt.Sprintf("image.tag=%s,initImage.tag=%s", tag, tag))
 	output, err := cmd.CombinedOutput()
 	if err != nil {
 		klog.Errorf("couldn't install yurt-manager, %v", err)
diff --git a/test/e2e/cmd/init/init.go b/test/e2e/cmd/init/init.go
index 2d21ef0b44a..2c9c21ca02b 100644
--- a/test/e2e/cmd/init/init.go
+++ b/test/e2e/cmd/init/init.go
@@ -105,6 +105,7 @@ var (
 	yurtManagerImageFormat = "openyurt/yurt-manager:%s"
 	nodeServantImageFormat = "openyurt/node-servant:%s"
 	yurtIotDockImageFormat = "openyurt/yurt-iot-dock:%s"
+	CRDUpgraderImageFormat = "openyurt/crd-upgrader:%s"
 )
 
 func NewInitCMD(out io.Writer) *cobra.Command {
@@ -218,6 +219,7 @@ func (o *kindOptions) Config() *initializerConfig {
 		YurtManagerImage:  fmt.Sprintf(yurtManagerImageFormat, o.OpenYurtVersion),
 		NodeServantImage:  fmt.Sprintf(nodeServantImageFormat, o.OpenYurtVersion),
 		yurtIotDockImage:  fmt.Sprintf(yurtIotDockImageFormat, o.OpenYurtVersion),
+		CRDUpgraderImage:  fmt.Sprintf(CRDUpgraderImageFormat, o.OpenYurtVersion),
 		DisableDefaultCNI: o.DisableDefaultCNI,
 	}
 }
@@ -261,6 +263,7 @@ type initializerConfig struct {
 	YurtManagerImage  string
 	NodeServantImage  string
 	yurtIotDockImage  string
+	CRDUpgraderImage  string
 	DisableDefaultCNI bool
 }
 
@@ -501,6 +504,7 @@ func (ki *Initializer) prepareImages() error {
 		ki.YurtManagerImage,
 		ki.NodeServantImage,
 		ki.yurtIotDockImage,
+		ki.CRDUpgraderImage,
 	}, ki.CloudNodes); err != nil {
 		return err
 	}