diff --git a/dgraphtest/config.go b/dgraphtest/config.go
index 57a1af0957b..35ea5f40c7d 100644
--- a/dgraphtest/config.go
+++ b/dgraphtest/config.go
@@ -87,7 +87,7 @@ func AllUpgradeCombos(v20 bool) []UpgradeCombo {
 		}...)
 
 		mainCombos = append(mainCombos, []UpgradeCombo{
-			{"v20.11.2-rc1-16-g4d041a3a", localVersion, BackupRestore},
+			{"v20.11.2-rc1-16-g4d041a3a", "v23.0.1", BackupRestore},
 		}...)
 	}
 
diff --git a/dgraphtest/local_cluster.go b/dgraphtest/local_cluster.go
index c51d3a579ae..aafcd44c94e 100644
--- a/dgraphtest/local_cluster.go
+++ b/dgraphtest/local_cluster.go
@@ -1082,3 +1082,42 @@ func (c *LocalCluster) GeneratePlugins(raceEnabled bool) error {
 
 	return nil
 }
+
+func (c *LocalCluster) RunUpgradeTool(from, to string) error {
+	isAncestor, err := IsHigherVersion("4400610b249713bbf2af5448155dd5819546d1a0", from)
+	if err != nil {
+		return errors.Wrapf(err, "error identifying ancestor relationship")
+	}
+	if !isAncestor {
+		return nil
+	}
+
+	grpcPubPort, err := publicPort(c.dcli, c.alphas[0], alphaGrpcPort)
+	if err != nil {
+		return errors.Wrapf(err, "error finding alpha grpc public port")
+	}
+	grpcUrl := "localhost:"+grpcPubPort
+
+	httpPubPort, err := publicPort(c.dcli, c.alphas[0], alphaHttpPort)
+	if err != nil {
+		return errors.Wrapf(err, "error finding alpha http public port")
+	}
+	httpUrl := "http://localhost:"+httpPubPort
+
+	cmd := exec.Command("/Users/jassi/gitrepo/bin/darwin_arm64/dgraph", "upgrade", "--from", from, "--to", to, "--alpha", grpcUrl, "--alpha-http", httpUrl, "--deleteOld")
+	if c.conf.acl {
+		cmd = exec.Command("/Users/jassi/gitrepo/bin/darwin_arm64/dgraph", "upgrade", "--from", from, "--to", to, "--user", DefaultUser, "--password", DefaultPassword, "--alpha", grpcUrl, "--alpha-http", httpUrl, "--deleteOld")
+	}
+
+	if out, err := cmd.CombinedOutput(); err != nil {
+		if _, ok := err.(*exec.ExitError); ok {
+			log.Print("[INFO] upgrade tool succeeded")
+			return nil
+		}
+
+		return errors.Wrapf(err, "error running upgrade tool: %v", string(out))
+	}
+
+	log.Print("[INFO] upgrade tool succeeded")
+	return nil
+}
diff --git a/ee/acl/persistent_queries_test.go b/ee/acl/persistent_queries_test.go
new file mode 100644
index 00000000000..6a046e1079a
--- /dev/null
+++ b/ee/acl/persistent_queries_test.go
@@ -0,0 +1,72 @@
+//go:build (!oss && integration) || upgrade
+
+/*
+ * Copyright 2023 Dgraph Labs, Inc. and Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package acl
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/dgraph-io/dgraph/dgraphtest"
+	"github.com/dgraph-io/dgraph/x"
+)
+
+func (asuite *AclTestSuite) TestPersistentQuery() {
+	t := asuite.T()
+
+	// Galaxy Login
+	hcli, err := asuite.dc.HTTPClient()
+	require.NoError(t, err)
+	err = hcli.LoginIntoNamespace(dgraphtest.DefaultUser, dgraphtest.DefaultPassword, x.GalaxyNamespace)
+	require.NotNil(t, hcli.AccessJwt, "galaxy token is nil")
+	require.NoErrorf(t, err, "login as groot into namespace %d failed", x.GalaxyNamespace)
+
+	sch := `type Product {
+		productID: ID!
+		name: String @search(by: [term])
+	}`
+	require.NoError(t, hcli.UpdateGQLSchema(sch))
+
+	query := "query {queryProduct{productID}}"
+	b := sha256.Sum256([]byte(query))
+	hash := hex.EncodeToString(b[:])
+
+	var data1, data2 []byte
+	data1, err = hcli.PostPersistentQuery(query, hash)
+	require.NoError(t, err)
+
+	// Upgrade
+	asuite.Upgrade()
+
+	// run upgrade tool for 20.11.x
+	require.NoError(t, asuite.lc.RunUpgradeTool(asuite.uc.Before, asuite.uc.After))
+
+	// Galaxy Login
+	hcli, err = asuite.dc.HTTPClient()
+	require.NoError(t, err)
+	err = hcli.LoginIntoNamespace(dgraphtest.DefaultUser, dgraphtest.DefaultPassword, x.GalaxyNamespace)
+	require.NotNil(t, hcli.AccessJwt, "galaxy token is nil")
+	require.NoErrorf(t, err, "login as groot into namespace %d failed", x.GalaxyNamespace)
+
+	data2, err = hcli.PostPersistentQuery("", hash)
+	require.NoError(t, err)
+
+	require.NoError(t, dgraphtest.CompareJSON(string(data1), string(data2)))
+}
diff --git a/go.mod b/go.mod
index 1595c2b587b..634c273b634 100644
--- a/go.mod
+++ b/go.mod
@@ -61,7 +61,6 @@ require (
 	golang.org/x/text v0.12.0
 	golang.org/x/tools v0.9.3
 	google.golang.org/grpc v1.56.2
-	google.golang.org/protobuf v1.31.0
 	gopkg.in/square/go-jose.v2 v2.3.1
 	gopkg.in/yaml.v2 v2.4.0
 )
@@ -143,6 +142,7 @@ require (
 	google.golang.org/appengine v1.6.7 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20230711160842-782d3b101e98 // indirect
 	google.golang.org/grpc/examples v0.0.0-20230821201920-d51b3f41716d // indirect
+	google.golang.org/protobuf v1.31.0 // indirect
 	gopkg.in/DataDog/dd-trace-go.v1 v1.22.0 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect