diff --git a/roles/kubernetes/control-plane/defaults/main/main.yml b/roles/kubernetes/control-plane/defaults/main/main.yml
index 82c3bcd82..34671cd02 100644
--- a/roles/kubernetes/control-plane/defaults/main/main.yml
+++ b/roles/kubernetes/control-plane/defaults/main/main.yml
@@ -246,6 +246,12 @@ auto_renew_certificates_systemd_calendar: "Mon *-*-1,2,3,4,5,6,7 03:00:00"
 # we can opt out from the default behavior by setting kubeadm_upgrade_auto_cert_renewal to false
 kubeadm_upgrade_auto_cert_renewal: true
 
+# Number of kubeadm upgrade backups to retain in /etc/kubernetes/tmp/.
+# Set to a negative value to retain all backups (default, no cleanup).
+# Set to 0 to remove all backups after upgrade.
+kubeadm_backup_retention_count: -1
+
+
 # Add Subject Alternative Names to the Kubernetes apiserver certificates.
 # Useful if you access the API from multiples load balancers, for instance.
 supplementary_addresses_in_ssl_keys: []
diff --git a/roles/kubernetes/control-plane/tasks/kubeadm-backup-cleanup.yml b/roles/kubernetes/control-plane/tasks/kubeadm-backup-cleanup.yml
new file mode 100644
index 000000000..ec8dc198a
--- /dev/null
+++ b/roles/kubernetes/control-plane/tasks/kubeadm-backup-cleanup.yml
@@ -0,0 +1,46 @@
+---
+- name: Find kubeadm etcd backup directories
+  ansible.builtin.find:
+    paths: "/etc/kubernetes/tmp"
+    file_type: directory
+    recurse: false
+    patterns: "kubeadm-backup-*"
+  register: _kubeadm_etcd_backups
+  when: kubeadm_backup_retention_count >= 0
+
+- name: Remove old kubeadm etcd backups
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: absent
+  loop: >-
+    {{
+      (_kubeadm_etcd_backups.files
+      | sort(attribute='ctime', reverse=True)
+      )[kubeadm_backup_retention_count:]
+      | map(attribute='path')
+    }}
+  when: kubeadm_backup_retention_count >= 0
+
+- name: Find kubeadm temporary upgrade files
+  ansible.builtin.find:
+    paths: "/etc/kubernetes/tmp"
+    file_type: any
+    recurse: false
+    patterns:
+      - "kubeadm-kubelet-config*"
+      - "kubeadm-kubelet-env*"
+  register: _kubeadm_tmp_files
+  when: kubeadm_backup_retention_count >= 0
+
+- name: Remove old kubeadm temporary upgrade files
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: absent
+  loop: >-
+    {{
+      (_kubeadm_tmp_files.files
+      | sort(attribute='ctime', reverse=True)
+      )[kubeadm_backup_retention_count:]
+      | map(attribute='path')
+    }}
+  when: kubeadm_backup_retention_count >= 0
diff --git a/roles/kubernetes/control-plane/tasks/kubeadm-upgrade.yml b/roles/kubernetes/control-plane/tasks/kubeadm-upgrade.yml
index f075814c9..1ffd18153 100644
--- a/roles/kubernetes/control-plane/tasks/kubeadm-upgrade.yml
+++ b/roles/kubernetes/control-plane/tasks/kubeadm-upgrade.yml
@@ -86,3 +86,6 @@
   - kubeadm_scale_down_coredns_enabled
   - dns_mode not in ['coredns', 'coredns_dual']
   changed_when: false
+
+- name: Kubeadm | cleanup old upgrade backups
+  import_tasks: kubeadm-backup-cleanup.yml
diff --git a/tests/files/ubuntu22-calico-all-in-one-upgrade.yml b/tests/files/ubuntu22-calico-all-in-one-upgrade.yml
index 86a369fb3..7fd9c17a8 100644
--- a/tests/files/ubuntu22-calico-all-in-one-upgrade.yml
+++ b/tests/files/ubuntu22-calico-all-in-one-upgrade.yml
@@ -26,3 +26,7 @@ containerd_registries_mirrors:
       - host: http://172.19.16.11:5000
         capabilities: ["pull", "resolve", "push"]
         skip_verify: true
+
+# Upgrade cluster settings
+# set 0 to clean all kubeadm backups
+kubeadm_backup_retention_count: 0