diff --git a/tests/kafkatest/services/kafka/kafka.py b/tests/kafkatest/services/kafka/kafka.py
index af1133716f748..2daa7b8c3c0ba 100644
--- a/tests/kafkatest/services/kafka/kafka.py
+++ b/tests/kafkatest/services/kafka/kafka.py
@@ -842,8 +842,7 @@ def start_node(self, node, timeout_sec=60, **kwargs):
                     self.close_port(controller_listener)
 
         self.security_config.setup_node(node)
-        if self.quorum_info.using_zk or self.quorum_info.has_brokers: # TODO: SCRAM currently unsupported for controller quorum
-            self.maybe_setup_broker_scram_credentials(node)
+        self.maybe_setup_broker_scram_credentials(node)
 
         if self.quorum_info.using_kraft:
             # define controller.quorum.bootstrap.servers or controller.quorum.voters text
diff --git a/tests/kafkatest/tests/core/security_rolling_upgrade_test.py b/tests/kafkatest/tests/core/security_rolling_upgrade_test.py
index 96b2ba55194bf..448c80682dad7 100644
--- a/tests/kafkatest/tests/core/security_rolling_upgrade_test.py
+++ b/tests/kafkatest/tests/core/security_rolling_upgrade_test.py
@@ -121,7 +121,9 @@ def test_rolling_upgrade_phase_one(self, client_protocol, metadata_quorum):
         self.run_produce_consume_validate(lambda: time.sleep(1))
 
     @cluster(num_nodes=9)
-    @matrix(new_client_sasl_mechanism=[SecurityConfig.SASL_MECHANISM_PLAIN], metadata_quorum=[quorum.isolated_kraft])
+    @matrix(new_client_sasl_mechanism=[SecurityConfig.SASL_MECHANISM_PLAIN, SecurityConfig.SASL_MECHANISM_SCRAM_SHA_256,
+                                       SecurityConfig.SASL_MECHANISM_SCRAM_SHA_512],
+            metadata_quorum=[quorum.isolated_kraft])
     def test_rolling_upgrade_sasl_mechanism_phase_one(self, new_client_sasl_mechanism, metadata_quorum):
         """
         Start with a SASL/GSSAPI cluster, add new SASL mechanism, via a rolling upgrade, ensuring we could produce