diff --git a/controlplane/kubeadm/controllers/upgrade.go b/controlplane/kubeadm/controllers/upgrade.go
index 7ea5a222249f..d235e855f63d 100644
--- a/controlplane/kubeadm/controllers/upgrade.go
+++ b/controlplane/kubeadm/controllers/upgrade.go
@@ -18,6 +18,7 @@ package controllers
 
 import (
 	"context"
+	"k8s.io/apimachinery/pkg/util/intstr"
 
 	"github.com/blang/semver"
 	"github.com/pkg/errors"
@@ -110,6 +111,20 @@ func (r *KubeadmControlPlaneReconciler) upgradeControlPlane(
 		return ctrl.Result{}, errors.Wrap(err, "failed to upgrade kubelet config map")
 	}
 
+	// this should be already handled by the defaulting webhook, but during rolling upgrade it is possible that
+	// kcp version got updated first before the webhook pod update, then the new kcp does not have the default value
+	// then later on when webhook pod updated, kcp.spec have no updates, so the value not set and controller will have nil pointer
+	// so do a quick hack here to set the default if it's empty
+	if kcp.Spec.RolloutStrategy == nil {
+		ios1 := intstr.FromInt(1)
+		kcp.Spec.RolloutStrategy = &controlplanev1.RolloutStrategy{
+			Type: controlplanev1.RollingUpdateStrategyType,
+			RollingUpdate: &controlplanev1.RollingUpdate{
+				MaxSurge: &ios1,
+			},
+		}
+	}
+
 	switch kcp.Spec.RolloutStrategy.Type {
 	case controlplanev1.RollingUpdateStrategyType:
 		// RolloutStrategy is currently defaulted and validated to be RollingUpdate