diff --git a/Makefile b/Makefile
index 4c2c92c61..eefc24121 100644
--- a/Makefile
+++ b/Makefile
@@ -281,7 +281,8 @@ provision-tests-track-%:
 		INTEGRATION_TEST_RUN="TestIntegration/.+-TR$*" \
 		INTEGRATION_TEST_TRACK="$*" \
 		CUSTOM_CNI_URL=$(CUSTOM_CNI_URL) \
-		REGISTRY=$(IMAGE_REGISTRY)
+		REGISTRY=$(IMAGE_REGISTRY) \
+		ARTIFACTS=$(ARTIFACTS)
 
 # Assets for releases
 
diff --git a/hack/test/provision-tests.sh b/hack/test/provision-tests.sh
index 2f3d14f19..d88b6121e 100755
--- a/hack/test/provision-tests.sh
+++ b/hack/test/provision-tests.sh
@@ -40,4 +40,8 @@ case "${CUSTOM_CNI_URL:-false}" in
     ;;
 esac
 
-"${INTEGRATION_TEST}" -test.v -talos.talosctlpath "${TALOSCTL}" -talos.provision.mtu 1450 ${INTEGRATION_TEST_FLAGS}
+"${INTEGRATION_TEST}" -test.v \
+  -talos.talosctlpath "${TALOSCTL}" \
+  -talos.provision.mtu 1450  \
+  -talos.provision.cni-bundle-url ${ARTIFACTS}/talosctl-cni-bundle-'${ARCH}'.tar.gz \
+  ${INTEGRATION_TEST_FLAGS}
diff --git a/internal/integration/integration_test.go b/internal/integration/integration_test.go
index 9e1e463d5..c2472eabc 100644
--- a/internal/integration/integration_test.go
+++ b/internal/integration/integration_test.go
@@ -147,6 +147,7 @@ func init() {
 	flag.StringVar(&provision_test.DefaultSettings.TargetInstallImageRegistry, "talos.provision.target-installer-registry",
 		provision_test.DefaultSettings.TargetInstallImageRegistry, "image registry for target installer image (provision tests only)")
 	flag.StringVar(&provision_test.DefaultSettings.CustomCNIURL, "talos.provision.custom-cni-url", provision_test.DefaultSettings.CustomCNIURL, "custom CNI URL for the cluster (provision tests only)")
+	flag.StringVar(&provision_test.DefaultSettings.CNIBundleURL, "talos.provision.cni-bundle-url", provision_test.DefaultSettings.CNIBundleURL, "URL to download CNI bundle from")
 
 	allSuites = append(allSuites, api.GetAllSuites()...)
 	allSuites = append(allSuites, cli.GetAllSuites()...)
diff --git a/internal/integration/provision/provision.go b/internal/integration/provision/provision.go
index 1d32438f9..f925fece0 100644
--- a/internal/integration/provision/provision.go
+++ b/internal/integration/provision/provision.go
@@ -8,9 +8,14 @@
 package provision
 
 import (
+	"fmt"
+	"regexp"
+
 	"github.com/stretchr/testify/suite"
 
 	"github.com/talos-systems/talos/internal/integration/base"
+	"github.com/talos-systems/talos/pkg/machinery/constants"
+	"github.com/talos-systems/talos/pkg/version"
 )
 
 var allSuites []suite.TestingSuite
@@ -45,6 +50,8 @@ type Settings struct {
 	CustomCNIURL string
 	// Enable crashdump on failure.
 	CrashdumpEnabled bool
+	// CNI bundle for QEMU provisioner.
+	CNIBundleURL string
 }
 
 // DefaultSettings filled in by test runner.
@@ -57,4 +64,10 @@ var DefaultSettings = Settings{
 	MasterNodes:                3,
 	WorkerNodes:                1,
 	TargetInstallImageRegistry: "ghcr.io",
+	CNIBundleURL:               fmt.Sprintf("https://github.com/talos-systems/talos/releases/download/%s/talosctl-cni-bundle-%s.tar.gz", trimVersion(version.Tag), constants.ArchVariable),
+}
+
+func trimVersion(version string) string {
+	// remove anything extra after semantic version core, `v0.3.2-1-abcd` -> `v0.3.2`
+	return regexp.MustCompile(`(-\d+-g[0-9a-f]+)$`).ReplaceAllString(version, "")
 }
diff --git a/internal/integration/provision/upgrade.go b/internal/integration/provision/upgrade.go
index fd97c2717..5b265ae79 100644
--- a/internal/integration/provision/upgrade.go
+++ b/internal/integration/provision/upgrade.go
@@ -13,7 +13,6 @@ import (
 	"net"
 	"os"
 	"path/filepath"
-	"regexp"
 	"strings"
 	"time"
 
@@ -79,20 +78,7 @@ const (
 	currentK8sVersion  = "1.20.4"
 )
 
-var (
-	defaultNameservers = []net.IP{net.ParseIP("8.8.8.8"), net.ParseIP("1.1.1.1")}
-	defaultCNIBinPath  = []string{"/opt/cni/bin"}
-)
-
-const (
-	defaultCNIConfDir  = "/etc/cni/conf.d"
-	defaultCNICacheDir = "/var/lib/cni"
-)
-
-func trimVersion(version string) string {
-	// remove anything extra after semantic version core, `v0.3.2-1-abcd` -> `v0.3.2`
-	return regexp.MustCompile(`(-\d+-g[0-9a-f]+)$`).ReplaceAllString(version, "")
-}
+var defaultNameservers = []net.IP{net.ParseIP("8.8.8.8"), net.ParseIP("1.1.1.1")}
 
 // upgradeBetweenTwoLastReleases upgrades between two last releases of Talos.
 func upgradeBetweenTwoLastReleases() upgradeSpec {
@@ -224,6 +210,7 @@ type UpgradeSuite struct {
 	ctxCancel context.CancelFunc
 
 	stateDir string
+	cniDir   string
 }
 
 // SetupSuite ...
@@ -279,6 +266,7 @@ func (suite *UpgradeSuite) setupCluster() {
 	suite.Require().NoError(err)
 
 	suite.stateDir = filepath.Join(defaultStateDir, "clusters")
+	suite.cniDir = filepath.Join(defaultStateDir, "cni")
 
 	clusterName := suite.spec.ShortName
 
@@ -309,9 +297,11 @@ func (suite *UpgradeSuite) setupCluster() {
 			MTU:          DefaultSettings.MTU,
 			Nameservers:  defaultNameservers,
 			CNI: provision.CNIConfig{
-				BinPath:  defaultCNIBinPath,
-				ConfDir:  defaultCNIConfDir,
-				CacheDir: defaultCNICacheDir,
+				BinPath:  []string{filepath.Join(suite.cniDir, "bin")},
+				ConfDir:  filepath.Join(suite.cniDir, "conf.d"),
+				CacheDir: filepath.Join(suite.cniDir, "cache"),
+
+				BundleURL: DefaultSettings.CNIBundleURL,
 			},
 		},