diff --git a/roles/network_plugin/calico/templates/calicoctl.etcd.sh.j2 b/roles/network_plugin/calico/templates/calicoctl.etcd.sh.j2
index 8343ef8f817409a92abaab7da2ce9b88656a4b81..2dbdfa1243686bcc3ad08facc1bb5909dab1d2b7 100644
--- a/roles/network_plugin/calico/templates/calicoctl.etcd.sh.j2
+++ b/roles/network_plugin/calico/templates/calicoctl.etcd.sh.j2
@@ -3,4 +3,4 @@ ETCD_ENDPOINTS={{ etcd_access_addresses }} \
 ETCD_CA_CERT_FILE={{ calico_cert_dir }}/ca_cert.crt \
 ETCD_CERT_FILE={{ calico_cert_dir }}/cert.crt \
 ETCD_KEY_FILE={{ calico_cert_dir }}/key.pem \
-{{ bin_dir }}/calicoctl "$@"
+{{ bin_dir }}/calicoctl {% if calico_version is version('v3.20.0', '>=') %}--allow-version-mismatch{% endif %} "$@"
diff --git a/roles/network_plugin/calico/templates/calicoctl.kdd.sh.j2 b/roles/network_plugin/calico/templates/calicoctl.kdd.sh.j2
index a6c080cf4856cffbec5c855ae505cb33ccfc81d3..3af5bed1a0fdc1f77e222f21c057b54d3e471084 100644
--- a/roles/network_plugin/calico/templates/calicoctl.kdd.sh.j2
+++ b/roles/network_plugin/calico/templates/calicoctl.kdd.sh.j2
@@ -5,4 +5,4 @@ KUBECONFIG=/etc/kubernetes/admin.conf \
 {% else %}
 KUBECONFIG=/etc/cni/net.d/calico-kubeconfig \
 {% endif %}
-{{ bin_dir }}/calicoctl "$@"
+{{ bin_dir }}/calicoctl {% if calico_version is version('v3.20.0', '>=') %}--allow-version-mismatch{% endif %} "$@"