diff --git a/Makefile b/Makefile
index a9b849f8f..f9a18133a 100644
--- a/Makefile
+++ b/Makefile
@@ -137,6 +137,8 @@ $(GOBUILDDIR):
 	@mkdir -p $(ORGDIR)
 	@rm -f $(REPODIR) && ln -sf ../../../.. $(REPODIR)
 	GOPATH=$(GOBUILDDIR) $(PULSAR) go flatten -V $(VENDORDIR)
+	# Note: Next library is not vendored, since we always want the latest version
+	GOPATH=$(GOBUILDDIR) go get github.com/arangodb/go-upgrade-rules
 
 $(CACHEVOL):
 	@docker volume create $(CACHEVOL)
diff --git a/pkg/deployment/reconcile/plan_builder.go b/pkg/deployment/reconcile/plan_builder.go
index abbbfeb76..56ed4008e 100644
--- a/pkg/deployment/reconcile/plan_builder.go
+++ b/pkg/deployment/reconcile/plan_builder.go
@@ -25,6 +25,7 @@ package reconcile
 import (
 	"strings"
 
+	upgraderules "github.com/arangodb/go-upgrade-rules"
 	"github.com/rs/zerolog"
 	"github.com/rs/zerolog/log"
 	"k8s.io/api/core/v1"
@@ -215,11 +216,11 @@ func podNeedsUpgrading(p v1.Pod, spec api.DeploymentSpec, images api.ImageInfoLi
 		// Image changed, check if change is allowed
 		specVersion := specImageInfo.ArangoDBVersion
 		podVersion := podImageInfo.ArangoDBVersion
-		if specVersion.Major() != podVersion.Major() {
+		if err := upgraderules.CheckUpgradeRules(podVersion, specVersion); err != nil {
 			// E.g. 3.x -> 4.x, we cannot allow automatically
 			return upgradeDecision{UpgradeNeeded: true, UpgradeAllowed: false}
 		}
-		if specVersion.Minor() != podVersion.Minor() {
+		if specVersion.Major() != podVersion.Major() || specVersion.Minor() != podVersion.Minor() {
 			// Is allowed, with `--database.auto-upgrade`
 			return upgradeDecision{
 				UpgradeNeeded:     true,