diff --git a/cmd/clusterctl/client/cluster/cert_manager.go b/cmd/clusterctl/client/cluster/cert_manager.go
index 97bc535310d5..9103d287dbda 100644
--- a/cmd/clusterctl/client/cluster/cert_manager.go
+++ b/cmd/clusterctl/client/cluster/cert_manager.go
@@ -49,17 +49,12 @@ const (
 	certmanagerVersionAnnotation = "certmanager.clusterctl.cluster.x-k8s.io/version"
 	certmanagerHashAnnotation    = "certmanager.clusterctl.cluster.x-k8s.io/hash"
 
-	// NOTE: // If the cert-manager.yaml asset is modified, this line **MUST** be updated
-	// accordingly else future upgrades of the cert-manager component will not
-	// be possible, as there'll be no record of the version installed.
-	embeddedCertManagerManifestVersion = "v0.16.1"
-
-	// NOTE: The hash is used to ensure that when the cert-manager.yaml file is updated,
-	// the version number marker here is _also_ updated.
-	// You can either generate the SHA256 hash of the file, or alternatively
-	// run `go test` against this package. THe Test_VersionMarkerUpToDate will output
-	// the expected hash if it does not match the hash here.
-	embeddedCertManagerManifestHash = "af8c08a8eb65d102ba98889a89f4ad1d3db5d302edb5b8f8f3e69bb992faa211"
+	embeddedCertManagerManifestVersion
+)
+
+var (
+	embeddedCertManagerManifestVersion string
+	embeddedCertManagerManifestHash string
 )
 
 // CertManagerUpgradePlan defines the upgrade plan if cert-manager needs to be
@@ -138,6 +133,26 @@ func (cm *certManagerClient) EnsureInstalled() error {
 	return cm.install()
 }
 
+func (cm *certManagerClient) EnsureManifestVersionandHash() error {
+	objs, err := cm.getManifestObjs()
+        if err != nil {
+                return err
+        }
+	embeddedCertManagerManifestHash := fmt.Sprintf("%x", sha256.Sum256(yaml))
+
+	for i := range objs {
+                o := objs[i]
+		if o.GetKind() == "CustomResourceDefinition" {
+			labels := o.GetLabels()
+			version, ok := labels["helm.sh/chart"]
+			if ok {
+				embeddedCertManagerManifestVersion = version
+			}
+		}
+        }
+	return nil
+}
+
 func (cm *certManagerClient) install() error {
 	// Gets the cert-manager objects from the embedded assets.
 	objs, err := cm.getManifestObjs()