diff --git a/jjb/metal3/job_capm3_e2e_k8s_upgrade_tests.yml b/jjb/metal3/job_capm3_e2e_k8s_upgrade_tests.yml
index 13f418d..8a8b181 100644
--- a/jjb/metal3/job_capm3_e2e_k8s_upgrade_tests.yml
+++ b/jjb/metal3/job_capm3_e2e_k8s_upgrade_tests.yml
@@ -89,6 +89,10 @@
         name: KUBERNETES_VERSION_UPGRADE_TO
         default: '{k8s_version_upgrade_to}'
         description: 'Kubernetes version upgrade to'
+    - string:
+        name: KUBECTL_SHA256
+        default: '{kubectl_sha256}'
+        description: 'Kubectl SHA256 digest matching KUBERNETES_VERSION_UPGRADE_FROM'
 
     properties:
     - build-discarder:
diff --git a/jjb/metal3/job_capm3_main_e2e_k8s_upgrade_tests.yml b/jjb/metal3/job_capm3_main_e2e_k8s_upgrade_tests.yml
index 21666f1..688c1cc 100644
--- a/jjb/metal3/job_capm3_main_e2e_k8s_upgrade_tests.yml
+++ b/jjb/metal3/job_capm3_main_e2e_k8s_upgrade_tests.yml
@@ -89,6 +89,10 @@
         name: KUBERNETES_VERSION_UPGRADE_TO
         default: '{k8s_version_upgrade_to}'
         description: 'Kubernetes version upgrade to'
+    - string:
+        name: KUBECTL_SHA256
+        default: '{kubectl_sha256}'
+        description: 'Kubectl SHA256 digest matching KUBERNETES_VERSION_UPGRADE_FROM'
 
     properties:
     - build-discarder:
diff --git a/jjb/metal3/job_keep_capm3_e2e_k8s_upgrade_tests.yml b/jjb/metal3/job_keep_capm3_e2e_k8s_upgrade_tests.yml
index fa005d4..d3c85af 100644
--- a/jjb/metal3/job_keep_capm3_e2e_k8s_upgrade_tests.yml
+++ b/jjb/metal3/job_keep_capm3_e2e_k8s_upgrade_tests.yml
@@ -93,6 +93,10 @@
         name: KUBERNETES_VERSION_UPGRADE_TO
         default: '{k8s_version_upgrade_to}'
         description: 'Kubernetes version upgrade to'
+    - string:
+        name: KUBECTL_SHA256
+        default: '{kubectl_sha256}'
+        description: 'Kubectl SHA256 digest matching KUBERNETES_VERSION_UPGRADE_FROM'
 
     properties:
     - build-discarder:
diff --git a/jjb/metal3/job_openstack_image_building.yml b/jjb/metal3/job_openstack_image_building.yml
index aadee7f..ba02f46 100644
--- a/jjb/metal3/job_openstack_image_building.yml
+++ b/jjb/metal3/job_openstack_image_building.yml
@@ -24,6 +24,8 @@
 # This job can be triggered manually or through a Github pull request. It creates a
 # pipeline job. The pipeline scripts are maintained in Nordix/metal3-dev-tools repository.
 
+# NOTE: KUBERNETES_VERSION and KUBECTL_SHA256 are changed as a pair
+
 - job-template:
     id: openstack_image_building
     name: '{job_prefix}_openstack_image_building'
@@ -38,6 +40,10 @@
         default: "v1.28.1"
         description: 'Kubernetes version'
     - string:
+        name: KUBECTL_SHA256
+        default: 'e7a7d6f9d06fab38b4128785aa80f65c54f6675a0d2abef655259ddd852274e1'  # v1.28.1
+        description: 'Kubectl SHA256 digest matching KUBERNETES_VERSION'
+    - string:
         name: KIND_NODE_IMAGE_VERSION
         default: "v1.28.0"
         description: 'Kind node container image version'
diff --git a/jjb/metal3/job_openstack_node_image_building.yml b/jjb/metal3/job_openstack_node_image_building.yml
index 819624e..174a0f5 100644
--- a/jjb/metal3/job_openstack_node_image_building.yml
+++ b/jjb/metal3/job_openstack_node_image_building.yml
@@ -24,6 +24,8 @@
 # This job can be triggered manually or through a Github pull request. It creates a
 # pipeline job. The pipeline scripts are maintained in Nordix/metal3-dev-tools repository.
 
+# NOTE: KUBERNETES_VERSION and KUBECTL_SHA256 are changed as a pair
+
 - job-template:
     id: openstack_node_image_building
     name: '{job_prefix}_openstack_node_image_building'
@@ -38,6 +40,10 @@
         default: "v1.28.1"
         description: 'Kubernetes version'
     - string:
+        name: KUBECTL_SHA256
+        default: 'e7a7d6f9d06fab38b4128785aa80f65c54f6675a0d2abef655259ddd852274e1'  # v1.28.1
+        description: 'Kubectl SHA256 digest matching KUBERNETES_VERSION'
+    - string:
         name: CRICTL_VERSION
         default: "v1.28.0"
         description: 'CRICTL VERSION'
diff --git a/jjb/metal3/projects.yml b/jjb/metal3/projects.yml
index c533202..c13afb5 100644
--- a/jjb/metal3/projects.yml
+++ b/jjb/metal3/projects.yml
@@ -437,6 +437,7 @@
             - 1-27-1-28:
                 k8s_version_upgrade_from: v1.27.4
                 k8s_version_upgrade_to: v1.28.1
+                kubectl_sha256: 4685bfcf732260f72fce58379e812e091557ef1dfc1bc8084226c7891dd6028f  # v1.27.4
                 capm3_release_branch: main
                 capm3_target_branch: main
                 target_branches:
@@ -510,6 +511,7 @@
             - 1-27-1-28:
                 k8s_version_upgrade_from: v1.27.4
                 k8s_version_upgrade_to: v1.28.1
+                kubectl_sha256: 4685bfcf732260f72fce58379e812e091557ef1dfc1bc8084226c7891dd6028f  # v1.27.4
                 capm3_release_branch: main
                 capm3_target_branch: main
                 target_branches: