diff --git a/pkg/embeddedcluster/upgrade.go b/pkg/embeddedcluster/upgrade.go
index d85393133d..918f0b2372 100644
--- a/pkg/embeddedcluster/upgrade.go
+++ b/pkg/embeddedcluster/upgrade.go
@@ -9,6 +9,7 @@ import (
 	"io"
 	"log"
 	"net/http"
+	"net/url"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -211,7 +212,7 @@ func downloadUpgradeBinary(ctx context.Context, license kotsv1beta1.License, ver
 }
 
 func newDownloadUpgradeBinaryRequest(ctx context.Context, license kotsv1beta1.License, versionLabel string) (*http.Request, error) {
-	url := fmt.Sprintf("%s/clusterconfig/artifact/operator?versionLabel=%s", license.Spec.Endpoint, versionLabel)
+	url := fmt.Sprintf("%s/clusterconfig/artifact/operator?versionLabel=%s", license.Spec.Endpoint, url.QueryEscape(versionLabel))
 	req, err := util.NewRequest(http.MethodGet, url, nil)
 	if err != nil {
 		return nil, fmt.Errorf("new request: %w", err)
diff --git a/pkg/replicatedapp/embeddedcluster.go b/pkg/replicatedapp/embeddedcluster.go
index 543683ab25..9481e0e18f 100644
--- a/pkg/replicatedapp/embeddedcluster.go
+++ b/pkg/replicatedapp/embeddedcluster.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"net/url"
 	"os"
 
 	"github.com/pkg/errors"
@@ -15,7 +16,7 @@ import (
 )
 
 func GetECVersionForRelease(license *kotsv1beta1.License, versionLabel string) (string, error) {
-	url := fmt.Sprintf("%s/clusterconfig/version/Installer?versionLabel=%s", license.Spec.Endpoint, versionLabel)
+	url := fmt.Sprintf("%s/clusterconfig/version/Installer?versionLabel=%s", license.Spec.Endpoint, url.QueryEscape(versionLabel))
 	req, err := util.NewRequest("GET", url, nil)
 	if err != nil {
 		return "", errors.Wrap(err, "failed to call newrequest")
@@ -49,7 +50,7 @@ func GetECVersionForRelease(license *kotsv1beta1.License, versionLabel string) (
 }
 
 func DownloadKOTSBinary(license *kotsv1beta1.License, versionLabel string) (string, error) {
-	url := fmt.Sprintf("%s/clusterconfig/artifact/kots?versionLabel=%s", license.Spec.Endpoint, versionLabel)
+	url := fmt.Sprintf("%s/clusterconfig/artifact/kots?versionLabel=%s", license.Spec.Endpoint, url.QueryEscape(versionLabel))
 	req, err := util.NewRequest("GET", url, nil)
 	if err != nil {
 		return "", errors.Wrap(err, "failed to call newrequest")