diff --git a/pkg/kagent/install/uninstall.go b/pkg/kagent/install/uninstall.go
index 375ba5a228..604916271c 100644
--- a/pkg/kagent/install/uninstall.go
+++ b/pkg/kagent/install/uninstall.go
@@ -53,11 +53,10 @@ type UninstallOptions struct {
 	Confirm func(ctx context.Context, summary string) (bool, error)
 }
 
-// Uninstall removes the releases in the reverse of install order. It keeps
-// CRDs, secrets, the database volume and the namespaces unless
-// opts.IncludeCRDs or opts.Purge say otherwise.
+// Uninstall shows UninstallSummary to opts.Confirm, then runs
+// UninstallSteps.
 func (in *Installer) Uninstall(ctx context.Context, opts UninstallOptions) error {
-	summary, err := in.inventory(ctx, opts)
+	summary, err := in.UninstallSummary(ctx, opts)
 	if err != nil {
 		return err
 	}
@@ -70,6 +69,14 @@ func (in *Installer) Uninstall(ctx context.Context, opts UninstallOptions) error
 			return ErrAborted
 		}
 	}
+	return in.Run(ctx, in.UninstallSteps(opts))
+}
+
+// UninstallSteps returns the steps that remove the releases in the reverse of
+// install order. They keep CRDs, secrets, the database volume and the
+// namespaces unless opts.IncludeCRDs or opts.Purge say otherwise. They don't
+// call opts.Confirm.
+func (in *Installer) UninstallSteps(opts UninstallOptions) []Step {
 	steps := []Step{
 		{"Delete worker pools", in.deleteWorkerPools},
 		{"Uninstall Substrate", in.uninstallStep(substrateRelease)},
@@ -86,11 +93,11 @@ func (in *Installer) Uninstall(ctx context.Context, opts UninstallOptions) error
 			Step{"Delete namespaces", in.deleteNamespaces},
 		)
 	}
-	return in.Run(ctx, steps)
+	return steps
 }
 
-// inventory describes what Uninstall will remove, for opts.Confirm.
-func (in *Installer) inventory(ctx context.Context, opts UninstallOptions) (string, error) {
+// UninstallSummary describes what UninstallSteps will remove.
+func (in *Installer) UninstallSummary(ctx context.Context, opts UninstallOptions) (string, error) {
 	var installed []string
 	for _, r := range allReleases {
 		rel, err := in.helm.get(r)
diff --git a/pkg/kagent/install/upgrade.go b/pkg/kagent/install/upgrade.go
index e57eaf01d8..f83b08430c 100644
--- a/pkg/kagent/install/upgrade.go
+++ b/pkg/kagent/install/upgrade.go
@@ -52,8 +52,20 @@ type UpgradeOptions struct {
 	Out    io.Writer
 }
 
-// Upgrade moves every release to the charts in this binary.
+// Upgrade runs UpgradeSteps.
 func (in *Installer) Upgrade(ctx context.Context, opts UpgradeOptions) error {
+	steps, err := in.UpgradeSteps(ctx, opts)
+	if err != nil {
+		return err
+	}
+	return in.Run(ctx, steps)
+}
+
+// UpgradeSteps returns the steps that move every release to the charts in
+// this binary. It reads the cluster to check for the microVM SandboxConfig.
+// After it is called, the Installer's helm steps upgrade releases across
+// chart versions.
+func (in *Installer) UpgradeSteps(ctx context.Context, opts UpgradeOptions) ([]Step, error) {
 	in.upgrading = true
 	steps := []Step{
 		{"Check versions", in.checkVersions},
@@ -63,7 +75,7 @@ func (in *Installer) Upgrade(ctx context.Context, opts UpgradeOptions) error {
 		for _, u := range upgradeOrder {
 			steps = append(steps, Step{"Diff " + u.r.name, in.diffStep(u.r, in.valuesFor(u.r), opts.Out)})
 		}
-		return in.Run(ctx, steps)
+		return steps, nil
 	}
 	steps = append(steps,
 		Step{"Create pod certificate CAs", in.createPodCertCAs},
@@ -77,7 +89,7 @@ func (in *Installer) Upgrade(ctx context.Context, opts UpgradeOptions) error {
 	// A new release may pin new microVM assets.
 	microVM, err := in.hasMicroVMSandboxConfig(ctx)
 	if err != nil {
-		return err
+		return nil, err
 	}
 	if microVM {
 		steps = append(steps,
@@ -86,7 +98,7 @@ func (in *Installer) Upgrade(ctx context.Context, opts UpgradeOptions) error {
 		)
 	}
 	steps = append(steps, Step{"Check API", in.checkAPI})
-	return in.Run(ctx, steps)
+	return steps, nil
 }
 
 // hasMicroVMSandboxConfig reports whether the microvm SandboxConfig exists.