diff --git a/lib/automaticupgrades/config.go b/lib/automaticupgrades/config.go
index f16d8c5673140..acfd61236b95e 100644
--- a/lib/automaticupgrades/config.go
+++ b/lib/automaticupgrades/config.go
@@ -19,13 +19,15 @@
 package automaticupgrades
 
 import (
+	"bytes"
 	"context"
 	"os"
 	"os/exec"
 	"strconv"
-	"strings"
 
 	log "github.com/sirupsen/logrus"
+
+	"github.com/gravitational/teleport/lib/automaticupgrades/version"
 )
 
 const (
@@ -78,11 +80,14 @@ func GetUpgraderVersion(ctx context.Context) string {
 		out, err := exec.CommandContext(ctx, teleportUpgradeScript, "version").Output()
 		if err != nil {
 			log.WithError(err).Debug("Failed to exec /usr/sbin/teleport-upgrade version command.")
-		} else {
-			if version := strings.TrimSpace(string(out)); version != "" {
-				return version
-			}
+			return ""
+		}
+		ver, err := version.EnsureSemver(string(bytes.TrimSpace(out)))
+		if err != nil {
+			log.WithError(err).Debug("Unexpected teleport-upgrade version.")
+			return ""
 		}
+		return ver
 	}
 	return os.Getenv(EnvUpgraderVersion)
 }
diff --git a/lib/service/service.go b/lib/service/service.go
index b1c1f225fb4fe..40c6e9407bd27 100644
--- a/lib/service/service.go
+++ b/lib/service/service.go
@@ -1091,6 +1091,9 @@ func NewTeleport(cfg *servicecfg.Config) (*TeleportProcess, error) {
 
 	upgraderKind := os.Getenv(automaticupgrades.EnvUpgrader)
 	upgraderVersion := automaticupgrades.GetUpgraderVersion(process.GracefulExitContext())
+	if upgraderVersion == "" {
+		upgraderKind = ""
+	}
 
 	// Instances deployed using the AWS OIDC integration are automatically updated
 	// by the proxy. The instance heartbeat should properly reflect that.