diff --git a/internal/versions/components/components.go b/internal/versions/components/components.go
index 4520ee7f0..88c36850f 100644
--- a/internal/versions/components/components.go
+++ b/internal/versions/components/components.go
@@ -83,3 +83,14 @@ func (c Components) GetKubeadmComponent() (*Component, error) {
 	}
 	return nil, errors.New("kubeadm component not found")
 }
+
+// GetUpgradableComponents returns only those Components that should be passed to the upgrade-agent.
+func (c Components) GetUpgradableComponents() Components {
+	var cs Components
+	for _, c := range c {
+		if strings.HasPrefix(c.Url, "data:") || strings.HasSuffix(c.InstallPath, "kubeadm") {
+			cs = append(cs, c)
+		}
+	}
+	return cs
+}
diff --git a/internal/versions/components/components_test.go b/internal/versions/components/components_test.go
index e32516ec9..c5f153c32 100644
--- a/internal/versions/components/components_test.go
+++ b/internal/versions/components/components_test.go
@@ -1,9 +1,3 @@
-/*
-Copyright (c) Edgeless Systems GmbH
-
-SPDX-License-Identifier: AGPL-3.0-only
-*/
-
 package components
 
 import (
@@ -14,6 +8,46 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+var (
+	crictl = &Component{
+		Url:         "https://github.com/kubernetes-sigs/cri-tools/releases/download/v1.28.0/crictl-v1.28.0-linux-amd64.tar.gz", // renovate:crictl-release
+		Hash:        "sha256:8dc78774f7cbeaf787994d386eec663f0a3cf24de1ea4893598096cb39ef2508",
+		InstallPath: "/bin",
+		Extract:     true,
+	}
+	kubeadm = &Component{
+		Url:         "https://storage.googleapis.com/kubernetes-release/release/v1.26.11/bin/linux/amd64/kubeadm", // renovate:kubernetes-release
+		Hash:        "sha256:58f886e39e517ba1a92493f136e80f1b6ea9362966ad9d2accdf2133004161f2",
+		InstallPath: "/bin/kubeadm",
+	}
+	kubeapi = &Component{
+		Url:         "data:application/json;base64,W3sib3AiOiJyZXBsYWNlIiwicGF0aCI6Ii9zcGVjL2NvbnRhaW5lcnMvMC9pbWFnZSIsInZhbHVlIjoicmVnaXN0cnkuazhzLmlvL2t1YmUtYXBpc2VydmVyOnYxLjI2LjExQHNoYTI1NjozOTUzNWQwZWZlODk1YWU5MWI1NTExZmRhZGI1MmVjOTMyOWYzODk4NzYxMTYzYThjMGRlMjAzZTIzZTMzODUzIn1d",
+		InstallPath: "/etc/kubernetes/patches/kube-apiserver+json.json",
+	}
+)
+
+func TestGetKubeadmComponent(t *testing.T) {
+	assert := assert.New(t)
+	got, err := Components{crictl, kubeadm, kubeapi}.GetKubeadmComponent()
+	assert.NoError(err)
+	assert.Same(kubeadm, got)
+}
+
+func TestGetKubeadmComponentWithoutKubeadm(t *testing.T) {
+	assert := assert.New(t)
+	got, err := Components{crictl, kubeapi}.GetKubeadmComponent()
+	assert.Error(err)
+	assert.Nil(got)
+}
+
+func TestGetUpgradableComponents(t *testing.T) {
+	assert := assert.New(t)
+	got := Components{crictl, kubeadm, kubeapi}.GetUpgradableComponents()
+	assert.Contains(got, kubeadm)
+	assert.Contains(got, kubeapi)
+	assert.NotContains(got, crictl)
+}
+
 func TestUnmarshalComponents(t *testing.T) {
 	assert := assert.New(t)
 	require := require.New(t)