diff --git a/roles/network_plugin/calico/templates/calicoctl.etcd.sh.j2 b/roles/network_plugin/calico/templates/calicoctl.etcd.sh.j2
index 8343ef8f8..2dbdfa124 100644
--- a/roles/network_plugin/calico/templates/calicoctl.etcd.sh.j2
+++ b/roles/network_plugin/calico/templates/calicoctl.etcd.sh.j2
@@ -3,4 +3,4 @@ ETCD_ENDPOINTS={{ etcd_access_addresses }} \
 ETCD_CA_CERT_FILE={{ calico_cert_dir }}/ca_cert.crt \
 ETCD_CERT_FILE={{ calico_cert_dir }}/cert.crt \
 ETCD_KEY_FILE={{ calico_cert_dir }}/key.pem \
-{{ bin_dir }}/calicoctl "$@"
+{{ bin_dir }}/calicoctl {% if calico_version is version('v3.20.0', '>=') %}--allow-version-mismatch{% endif %} "$@"
diff --git a/roles/network_plugin/calico/templates/calicoctl.kdd.sh.j2 b/roles/network_plugin/calico/templates/calicoctl.kdd.sh.j2
index a6c080cf4..3af5bed1a 100644
--- a/roles/network_plugin/calico/templates/calicoctl.kdd.sh.j2
+++ b/roles/network_plugin/calico/templates/calicoctl.kdd.sh.j2
@@ -5,4 +5,4 @@ KUBECONFIG=/etc/kubernetes/admin.conf \
 {% else %}
 KUBECONFIG=/etc/cni/net.d/calico-kubeconfig \
 {% endif %}
-{{ bin_dir }}/calicoctl "$@"
+{{ bin_dir }}/calicoctl {% if calico_version is version('v3.20.0', '>=') %}--allow-version-mismatch{% endif %} "$@"