diff --git a/cmd/clusterctl/client/cluster/cert_manager.go b/cmd/clusterctl/client/cluster/cert_manager.go
index a55f9737dd1f..435cfda24e14 100644
--- a/cmd/clusterctl/client/cluster/cert_manager.go
+++ b/cmd/clusterctl/client/cluster/cert_manager.go
@@ -19,7 +19,6 @@ package cluster
 import (
 	"context"
 	_ "embed"
-	"strings"
 	"time"
 
 	"github.com/blang/semver"
@@ -403,8 +402,7 @@ func (cm *certManagerClient) getManifestObjs(certManagerConfig config.CertManage
 	// we are using the same machinery to retrieve the file by using a fake provider object using
 	// the cert manager repository url.
 	// In order to avoid unnecessary calls to GitHub API, "latest" is replace with the version currently installed by clusterctl.
-	url := strings.Replace(certManagerConfig.URL(), "latest", certManagerConfig.Version(), 1)
-	certManagerFakeProvider := config.NewProvider("cert-manager", url, "")
+	certManagerFakeProvider := config.NewProvider("cert-manager", certManagerConfig.URL(), "")
 	certManagerRepository, err := cm.repositoryClientFactory(certManagerFakeProvider, cm.configClient)
 	if err != nil {
 		return nil, err
diff --git a/cmd/clusterctl/client/config/cert_manager.go b/cmd/clusterctl/client/config/cert_manager.go
index 87a6061f9985..73ea58d4b937 100644
--- a/cmd/clusterctl/client/config/cert_manager.go
+++ b/cmd/clusterctl/client/config/cert_manager.go
@@ -19,7 +19,7 @@ package config
 // CertManager defines cert-manager configuration.
 type CertManager interface {
 	// URL returns the name of the cert-manager repository.
-	// If empty, "https://github.com/cert-manager/cert-manager/releases/latest/cert-manager.yaml" will be used.
+	// If empty, "https://github.com/cert-manager/cert-manager/releases/{DefaultVersion}/cert-manager.yaml" will be used.
 	URL() string
 
 	// Version returns the cert-manager version to install.
diff --git a/cmd/clusterctl/client/config/cert_manager_client.go b/cmd/clusterctl/client/config/cert_manager_client.go
index a232829409f7..ebfbcb0d4b0d 100644
--- a/cmd/clusterctl/client/config/cert_manager_client.go
+++ b/cmd/clusterctl/client/config/cert_manager_client.go
@@ -30,9 +30,9 @@ const (
 	CertManagerDefaultVersion = "v1.9.1"
 
 	// CertManagerDefaultURL defines the default cert-manager repository url to be used by clusterctl.
-	// NOTE: At runtime /latest will be replaced with the CertManagerDefaultVersion or with the
+	// NOTE: At runtime CertManagerDefaultVersion may be replaced with the
 	// version defined by the user in the clusterctl configuration file.
-	CertManagerDefaultURL = "https://github.com/cert-manager/cert-manager/releases/latest/cert-manager.yaml"
+	CertManagerDefaultURL = "https://github.com/cert-manager/cert-manager/releases/" + CertManagerDefaultVersion + "/cert-manager.yaml"
 
 	// CertManagerDefaultTimeout defines the default cert-manager timeout to be used by clusterctl.
 	CertManagerDefaultTimeout = 10 * time.Minute
diff --git a/cmd/clusterctl/client/repository/goproxy.go b/cmd/clusterctl/client/repository/goproxy.go
index 983677154506..036e681b5133 100644
--- a/cmd/clusterctl/client/repository/goproxy.go
+++ b/cmd/clusterctl/client/repository/goproxy.go
@@ -60,26 +60,28 @@ func (g *goproxyClient) getVersions(ctx context.Context, base, owner, repository
 	var rawResponse []byte
 	var retryError error
 	_ = wait.PollImmediateWithContext(ctx, retryableOperationInterval, retryableOperationTimeout, func(ctx context.Context) (bool, error) {
+		retryError = nil
 		req, err := http.NewRequestWithContext(ctx, http.MethodGet, rawURL.String(), http.NoBody)
 		if err != nil {
-			return false, errors.Wrapf(err, "failed to create request")
+			return false, errors.Wrapf(err, "failed to get versions: failed to create request")
 		}
 
 		resp, err := http.DefaultClient.Do(req)
 		if err != nil {
-			retryError = errors.Wrapf(err, "failed to get versions")
+			retryError = errors.Wrapf(err, "failed to get versions: failed to do request")
 			return false, nil
 		}
 		defer resp.Body.Close()
 
 		if resp.StatusCode != 200 {
-			retryError = errors.Errorf("Request status code %d: %s", resp.StatusCode, resp.Status)
+			retryError = errors.Errorf("failed to get versions: request status code %d", resp.StatusCode)
 			return false, nil
 		}
 
 		rawResponse, err = io.ReadAll(resp.Body)
 		if err != nil {
-			return false, errors.Wrap(err, "error reading goproxy response body")
+			retryError = errors.Wrap(err, "failed to get versions: error reading goproxy response body")
+			return false, nil
 		}
 		return true, nil
 	})