diff --git a/ci-operator/config/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-main.yaml b/ci-operator/config/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-main.yaml
index 53121e34ae30f..e70aba44e65cc 100644
--- a/ci-operator/config/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-main.yaml
+++ b/ci-operator/config/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-main.yaml
@@ -7,6 +7,18 @@ base_images:
     name: release
     namespace: openshift
     tag: rhel-9-release-golang-1.23-openshift-4.19
+  operator-sdk:
+    name: "4.19"
+    namespace: origin
+    tag: operator-sdk
+  previous-bundle:
+    name: "4.19"
+    namespace: ocp
+    tag: cluster-resource-override-admission-operator-bundle
+  previous-operator:
+    name: "4.19"
+    namespace: ocp
+    tag: cluster-resource-override-admission-operator
 binary_build_commands: make build --warn-undefined-variables
 build_root:
   from_repository: true
@@ -117,6 +129,64 @@ tests:
         requests:
           cpu: 100m
     workflow: ipi-aws
+- as: e2e-aws-upgrade
+  skip_if_only_changed: ^docs/|^\.github|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$
+  steps:
+    cluster_profile: aws
+    test:
+    - as: install
+      cli: latest
+      commands: |
+        export NS=clusterresourceoverride-operator
+        oc create ns $NS
+
+        # Deploy the bundle which will fail to come up due to it pointing to the operator
+        # image via a tag that is only available to the presubmit job it is created
+        # within. This pipeline image is removed shortly after said job
+        # completes, so the csv needs to be patched to point the equivalent image that has been
+        # promoted.
+        operator-sdk run bundle --timeout=10m -n $NS --security-context-config restricted "$PREVIOUS_BUNDLE" || true
+        export OLD_CSV_NAME=$(oc get csv -n $NS -o jsonpath='{.items[0].metadata.name}')
+
+        oc patch csv -n $NS $OLD_CSV_NAME --type='json' -p="[{\"op\": \"replace\", \"path\": \"/spec/install/spec/deployments/0/spec/template/spec/containers/0/image\", \"value\": \"$PREVIOUS_OPERATOR\"}]"
+        sleep 10
+
+        # Delete the deployment which will then be recreated by the subscription controller with the correct image.
+        oc delete deployment -n $NS clusterresourceoverride-operator
+
+        oc wait --timeout=10m --for=create -n $NS deployment clusterresourceoverride-operator
+        oc wait --timeout=10m --for condition=Available -n $NS deployment clusterresourceoverride-operator
+      dependencies:
+      - env: PREVIOUS_BUNDLE
+        name: previous-bundle
+      - env: PREVIOUS_OPERATOR
+        name: previous-operator
+      from: operator-sdk
+      resources:
+        requests:
+          cpu: 100m
+    - as: upgrade
+      cli: latest
+      commands: |
+        export NS=clusterresourceoverride-operator
+        operator-sdk run bundle-upgrade --timeout 10m -n $NS --security-context-config restricted "$OO_BUNDLE"
+      dependencies:
+      - env: OO_BUNDLE
+        name: cluster-resource-override-admission-operator-bundle
+      from: operator-sdk
+      resources:
+        requests:
+          cpu: 100m
+    - as: test
+      cli: latest
+      commands: |
+        export KUBECTL=$(which oc)
+        make e2e
+      from: src
+      resources:
+        requests:
+          cpu: 100m
+    workflow: ipi-aws
 - as: verify-deps
   steps:
     env:
diff --git a/ci-operator/config/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-release-4.17.yaml b/ci-operator/config/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-release-4.17.yaml
index 475d4de0013cd..c03ba6ca78e8a 100644
--- a/ci-operator/config/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-release-4.17.yaml
+++ b/ci-operator/config/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-release-4.17.yaml
@@ -7,6 +7,18 @@ base_images:
     name: release
     namespace: openshift
     tag: rhel-9-release-golang-1.22-openshift-4.17
+  operator-sdk:
+    name: "4.19"
+    namespace: origin
+    tag: operator-sdk
+  previous-bundle:
+    name: "4.16"
+    namespace: ocp
+    tag: cluster-resource-override-admission-operator-bundle
+  previous-operator:
+    name: "4.16"
+    namespace: ocp
+    tag: cluster-resource-override-admission-operator
 binary_build_commands: make build --warn-undefined-variables
 build_root:
   from_repository: true
@@ -117,6 +129,72 @@ tests:
         requests:
           cpu: 100m
     workflow: ipi-aws
+- as: e2e-aws-upgrade
+  skip_if_only_changed: ^docs/|^\.github|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$
+  steps:
+    cluster_profile: aws
+    test:
+    - as: install
+      cli: latest
+      commands: |
+        export NS=clusterresourceoverride-operator
+        oc create ns $NS
+
+        # Deploy the bundle which will fail to come up due to it pointing to the operator
+        # image via a tag that is only available to the presubmit job it is created
+        # within. This pipeline image is removed shortly after said job
+        # completes, so the csv needs to be patched to point the equivalent image that has been
+        # promoted.
+        operator-sdk run bundle --timeout=10m -n $NS --security-context-config restricted "$PREVIOUS_BUNDLE" || true
+        export OLD_CSV_NAME=$(oc get csv -n $NS -o jsonpath='{.items[0].metadata.name}')
+
+        oc patch csv -n $NS $OLD_CSV_NAME --type='json' -p="[{\"op\": \"replace\", \"path\": \"/spec/install/spec/deployments/0/spec/template/spec/containers/0/image\", \"value\": \"$PREVIOUS_OPERATOR\"}]"
+        sleep 10
+
+        # Delete the deployment which will then be recreated by the subscription controller with the correct image.
+        oc delete deployment -n $NS clusterresourceoverride-operator
+
+        retries=0
+        while ! oc get -n $NS deployment clusterresourceoverride-operator; do
+          if [[ $retries -eq 10 ]]; then
+            echo max retries hit
+            exit 1
+          fi
+          sleep 1m
+          retries=$((retries+1))
+        done
+        oc wait --timeout=10m --for condition=Available -n $NS deployment clusterresourceoverride-operator
+      dependencies:
+      - env: PREVIOUS_BUNDLE
+        name: previous-bundle
+      - env: PREVIOUS_OPERATOR
+        name: previous-operator
+      from: operator-sdk
+      resources:
+        requests:
+          cpu: 100m
+    - as: upgrade
+      cli: latest
+      commands: |
+        export NS=clusterresourceoverride-operator
+        operator-sdk run bundle-upgrade --timeout 10m -n $NS --security-context-config restricted "$OO_BUNDLE"
+      dependencies:
+      - env: OO_BUNDLE
+        name: cluster-resource-override-admission-operator-bundle
+      from: operator-sdk
+      resources:
+        requests:
+          cpu: 100m
+    - as: test
+      cli: latest
+      commands: |
+        export KUBECTL=$(which oc)
+        make e2e
+      from: src
+      resources:
+        requests:
+          cpu: 100m
+    workflow: ipi-aws
 zz_generated_metadata:
   branch: release-4.17
   org: openshift
diff --git a/ci-operator/config/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-release-4.18.yaml b/ci-operator/config/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-release-4.18.yaml
index a48ac33f9f14f..85c7f0cbaee0d 100644
--- a/ci-operator/config/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-release-4.18.yaml
+++ b/ci-operator/config/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-release-4.18.yaml
@@ -7,6 +7,18 @@ base_images:
     name: release
     namespace: openshift
     tag: rhel-9-release-golang-1.22-openshift-4.18
+  operator-sdk:
+    name: "4.19"
+    namespace: origin
+    tag: operator-sdk
+  previous-bundle:
+    name: "4.17"
+    namespace: ocp
+    tag: cluster-resource-override-admission-operator-bundle
+  previous-operator:
+    name: "4.17"
+    namespace: ocp
+    tag: cluster-resource-override-admission-operator
 binary_build_commands: make build --warn-undefined-variables
 build_root:
   from_repository: true
@@ -117,6 +129,72 @@ tests:
         requests:
           cpu: 100m
     workflow: ipi-aws
+- as: e2e-aws-upgrade
+  skip_if_only_changed: ^docs/|^\.github|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$
+  steps:
+    cluster_profile: aws
+    test:
+    - as: install
+      cli: latest
+      commands: |
+        export NS=clusterresourceoverride-operator
+        oc create ns $NS
+
+        # Deploy the bundle which will fail to come up due to it pointing to the operator
+        # image via a tag that is only available to the presubmit job it is created
+        # within. This pipeline image is removed shortly after said job
+        # completes, so the csv needs to be patched to point the equivalent image that has been
+        # promoted.
+        operator-sdk run bundle --timeout=10m -n $NS --security-context-config restricted "$PREVIOUS_BUNDLE" || true
+        export OLD_CSV_NAME=$(oc get csv -n $NS -o jsonpath='{.items[0].metadata.name}')
+
+        oc patch csv -n $NS $OLD_CSV_NAME --type='json' -p="[{\"op\": \"replace\", \"path\": \"/spec/install/spec/deployments/0/spec/template/spec/containers/0/image\", \"value\": \"$PREVIOUS_OPERATOR\"}]"
+        sleep 10
+
+        # Delete the deployment which will then be recreated by the subscription controller with the correct image.
+        oc delete deployment -n $NS clusterresourceoverride-operator
+
+        retries=0
+        while ! oc get -n $NS deployment clusterresourceoverride-operator; do
+          if [[ $retries -eq 10 ]]; then
+            echo max retries hit
+            exit 1
+          fi
+          sleep 1m
+          retries=$((retries+1))
+        done
+        oc wait --timeout=10m --for condition=Available -n $NS deployment clusterresourceoverride-operator
+      dependencies:
+      - env: PREVIOUS_BUNDLE
+        name: previous-bundle
+      - env: PREVIOUS_OPERATOR
+        name: previous-operator
+      from: operator-sdk
+      resources:
+        requests:
+          cpu: 100m
+    - as: upgrade
+      cli: latest
+      commands: |
+        export NS=clusterresourceoverride-operator
+        operator-sdk run bundle-upgrade --timeout 10m -n $NS --security-context-config restricted "$OO_BUNDLE"
+      dependencies:
+      - env: OO_BUNDLE
+        name: cluster-resource-override-admission-operator-bundle
+      from: operator-sdk
+      resources:
+        requests:
+          cpu: 100m
+    - as: test
+      cli: latest
+      commands: |
+        export KUBECTL=$(which oc)
+        make e2e
+      from: src
+      resources:
+        requests:
+          cpu: 100m
+    workflow: ipi-aws
 zz_generated_metadata:
   branch: release-4.18
   org: openshift
diff --git a/ci-operator/config/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-release-4.19.yaml b/ci-operator/config/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-release-4.19.yaml
index 189fd201d5f30..bc8b9fe79c3af 100644
--- a/ci-operator/config/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-release-4.19.yaml
+++ b/ci-operator/config/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-release-4.19.yaml
@@ -7,6 +7,18 @@ base_images:
     name: release
     namespace: openshift
     tag: rhel-9-release-golang-1.23-openshift-4.19
+  operator-sdk:
+    name: "4.19"
+    namespace: origin
+    tag: operator-sdk
+  previous-bundle:
+    name: "4.18"
+    namespace: ocp
+    tag: cluster-resource-override-admission-operator-bundle
+  previous-operator:
+    name: "4.18"
+    namespace: ocp
+    tag: cluster-resource-override-admission-operator
 binary_build_commands: make build --warn-undefined-variables
 build_root:
   from_repository: true
@@ -117,6 +129,64 @@ tests:
         requests:
           cpu: 100m
     workflow: ipi-aws
+- as: e2e-aws-upgrade
+  skip_if_only_changed: ^docs/|^\.github|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$
+  steps:
+    cluster_profile: aws
+    test:
+    - as: install
+      cli: latest
+      commands: |
+        export NS=clusterresourceoverride-operator
+        oc create ns $NS
+
+        # Deploy the bundle which will fail to come up due to it pointing to the operator
+        # image via a tag that is only available to the presubmit job it is created
+        # within. This pipeline image is removed shortly after said job
+        # completes, so the csv needs to be patched to point the equivalent image that has been
+        # promoted.
+        operator-sdk run bundle --timeout=10m -n $NS --security-context-config restricted "$PREVIOUS_BUNDLE" || true
+        export OLD_CSV_NAME=$(oc get csv -n $NS -o jsonpath='{.items[0].metadata.name}')
+
+        oc patch csv -n $NS $OLD_CSV_NAME --type='json' -p="[{\"op\": \"replace\", \"path\": \"/spec/install/spec/deployments/0/spec/template/spec/containers/0/image\", \"value\": \"$PREVIOUS_OPERATOR\"}]"
+        sleep 10
+
+        # Delete the deployment which will then be recreated by the subscription controller with the correct image.
+        oc delete deployment -n $NS clusterresourceoverride-operator
+
+        oc wait --timeout=10m --for=create -n $NS deployment clusterresourceoverride-operator
+        oc wait --timeout=10m --for condition=Available -n $NS deployment clusterresourceoverride-operator
+      dependencies:
+      - env: PREVIOUS_BUNDLE
+        name: previous-bundle
+      - env: PREVIOUS_OPERATOR
+        name: previous-operator
+      from: operator-sdk
+      resources:
+        requests:
+          cpu: 100m
+    - as: upgrade
+      cli: latest
+      commands: |
+        export NS=clusterresourceoverride-operator
+        operator-sdk run bundle-upgrade --timeout 10m -n $NS --security-context-config restricted "$OO_BUNDLE"
+      dependencies:
+      - env: OO_BUNDLE
+        name: cluster-resource-override-admission-operator-bundle
+      from: operator-sdk
+      resources:
+        requests:
+          cpu: 100m
+    - as: test
+      cli: latest
+      commands: |
+        export KUBECTL=$(which oc)
+        make e2e
+      from: src
+      resources:
+        requests:
+          cpu: 100m
+    workflow: ipi-aws
 - as: verify-deps
   steps:
     env:
diff --git a/ci-operator/config/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-release-4.20.yaml b/ci-operator/config/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-release-4.20.yaml
index 5da22510691d5..521a494b477ea 100644
--- a/ci-operator/config/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-release-4.20.yaml
+++ b/ci-operator/config/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-release-4.20.yaml
@@ -7,6 +7,18 @@ base_images:
     name: release
     namespace: openshift
     tag: rhel-9-release-golang-1.23-openshift-4.19
+  operator-sdk:
+    name: "4.19"
+    namespace: origin
+    tag: operator-sdk
+  previous-bundle:
+    name: "4.19"
+    namespace: ocp
+    tag: cluster-resource-override-admission-operator-bundle
+  previous-operator:
+    name: "4.19"
+    namespace: ocp
+    tag: cluster-resource-override-admission-operator
 binary_build_commands: make build --warn-undefined-variables
 build_root:
   from_repository: true
@@ -118,6 +130,64 @@ tests:
         requests:
           cpu: 100m
     workflow: ipi-aws
+- as: e2e-aws-upgrade
+  skip_if_only_changed: ^docs/|^\.github|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$
+  steps:
+    cluster_profile: aws
+    test:
+    - as: install
+      cli: latest
+      commands: |
+        export NS=clusterresourceoverride-operator
+        oc create ns $NS
+
+        # Deploy the bundle which will fail to come up due to it pointing to the operator
+        # image via a tag that is only available to the presubmit job it is created
+        # within. This pipeline image is removed shortly after said job
+        # completes, so the csv needs to be patched to point the equivalent image that has been
+        # promoted.
+        operator-sdk run bundle --timeout=10m -n $NS --security-context-config restricted "$PREVIOUS_BUNDLE" || true
+        export OLD_CSV_NAME=$(oc get csv -n $NS -o jsonpath='{.items[0].metadata.name}')
+
+        oc patch csv -n $NS $OLD_CSV_NAME --type='json' -p="[{\"op\": \"replace\", \"path\": \"/spec/install/spec/deployments/0/spec/template/spec/containers/0/image\", \"value\": \"$PREVIOUS_OPERATOR\"}]"
+        sleep 10
+
+        # Delete the deployment which will then be recreated by the subscription controller with the correct image.
+        oc delete deployment -n $NS clusterresourceoverride-operator
+
+        oc wait --timeout=10m --for=create -n $NS deployment clusterresourceoverride-operator
+        oc wait --timeout=10m --for condition=Available -n $NS deployment clusterresourceoverride-operator
+      dependencies:
+      - env: PREVIOUS_BUNDLE
+        name: previous-bundle
+      - env: PREVIOUS_OPERATOR
+        name: previous-operator
+      from: operator-sdk
+      resources:
+        requests:
+          cpu: 100m
+    - as: upgrade
+      cli: latest
+      commands: |
+        export NS=clusterresourceoverride-operator
+        operator-sdk run bundle-upgrade --timeout 10m -n $NS --security-context-config restricted "$OO_BUNDLE"
+      dependencies:
+      - env: OO_BUNDLE
+        name: cluster-resource-override-admission-operator-bundle
+      from: operator-sdk
+      resources:
+        requests:
+          cpu: 100m
+    - as: test
+      cli: latest
+      commands: |
+        export KUBECTL=$(which oc)
+        make e2e
+      from: src
+      resources:
+        requests:
+          cpu: 100m
+    workflow: ipi-aws
 - as: verify-deps
   steps:
     env:
diff --git a/ci-operator/jobs/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-main-presubmits.yaml b/ci-operator/jobs/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-main-presubmits.yaml
index fec09bd3f6e9d..14116274c814c 100644
--- a/ci-operator/jobs/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-main-presubmits.yaml
+++ b/ci-operator/jobs/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-main-presubmits.yaml
@@ -199,6 +199,79 @@ presubmits:
         secret:
           secretName: result-aggregator
     trigger: (?m)^/test( | .* )e2e-aws-operator,?($|\s.*)
+  - agent: kubernetes
+    always_run: false
+    branches:
+    - ^main$
+    - ^main-
+    cluster: build06
+    context: ci/prow/e2e-aws-upgrade
+    decorate: true
+    labels:
+      ci-operator.openshift.io/cloud: aws
+      ci-operator.openshift.io/cloud-cluster-profile: aws
+      ci.openshift.io/generator: prowgen
+      pj-rehearse.openshift.io/can-be-rehearsed: "true"
+    name: pull-ci-openshift-cluster-resource-override-admission-operator-main-e2e-aws-upgrade
+    rerun_command: /test e2e-aws-upgrade
+    skip_if_only_changed: ^docs/|^\.github|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --lease-server-credentials-file=/etc/boskos/credentials
+        - --report-credentials-file=/etc/report/credentials
+        - --secret-dir=/secrets/ci-pull-credentials
+        - --target=e2e-aws-upgrade
+        command:
+        - ci-operator
+        image: ci-operator:latest
+        imagePullPolicy: Always
+        name: ""
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /etc/boskos
+          name: boskos
+          readOnly: true
+        - mountPath: /secrets/ci-pull-credentials
+          name: ci-pull-credentials
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: boskos
+        secret:
+          items:
+          - key: credentials
+            path: credentials
+          secretName: boskos-credentials
+      - name: ci-pull-credentials
+        secret:
+          secretName: ci-pull-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+    trigger: (?m)^/test( | .* )e2e-aws-upgrade,?($|\s.*)
   - agent: kubernetes
     always_run: true
     branches:
diff --git a/ci-operator/jobs/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-release-4.17-presubmits.yaml b/ci-operator/jobs/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-release-4.17-presubmits.yaml
index 551165390dede..f4f1524326ebb 100644
--- a/ci-operator/jobs/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-release-4.17-presubmits.yaml
+++ b/ci-operator/jobs/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-release-4.17-presubmits.yaml
@@ -199,6 +199,79 @@ presubmits:
         secret:
           secretName: result-aggregator
     trigger: (?m)^/test( | .* )e2e-aws-operator,?($|\s.*)
+  - agent: kubernetes
+    always_run: false
+    branches:
+    - ^release-4\.17$
+    - ^release-4\.17-
+    cluster: build06
+    context: ci/prow/e2e-aws-upgrade
+    decorate: true
+    labels:
+      ci-operator.openshift.io/cloud: aws
+      ci-operator.openshift.io/cloud-cluster-profile: aws
+      ci.openshift.io/generator: prowgen
+      pj-rehearse.openshift.io/can-be-rehearsed: "true"
+    name: pull-ci-openshift-cluster-resource-override-admission-operator-release-4.17-e2e-aws-upgrade
+    rerun_command: /test e2e-aws-upgrade
+    skip_if_only_changed: ^docs/|^\.github|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --lease-server-credentials-file=/etc/boskos/credentials
+        - --report-credentials-file=/etc/report/credentials
+        - --secret-dir=/secrets/ci-pull-credentials
+        - --target=e2e-aws-upgrade
+        command:
+        - ci-operator
+        image: ci-operator:latest
+        imagePullPolicy: Always
+        name: ""
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /etc/boskos
+          name: boskos
+          readOnly: true
+        - mountPath: /secrets/ci-pull-credentials
+          name: ci-pull-credentials
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: boskos
+        secret:
+          items:
+          - key: credentials
+            path: credentials
+          secretName: boskos-credentials
+      - name: ci-pull-credentials
+        secret:
+          secretName: ci-pull-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+    trigger: (?m)^/test( | .* )e2e-aws-upgrade,?($|\s.*)
   - agent: kubernetes
     always_run: true
     branches:
diff --git a/ci-operator/jobs/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-release-4.18-presubmits.yaml b/ci-operator/jobs/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-release-4.18-presubmits.yaml
index e86c98aac9c55..b12e5ae616039 100644
--- a/ci-operator/jobs/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-release-4.18-presubmits.yaml
+++ b/ci-operator/jobs/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-release-4.18-presubmits.yaml
@@ -199,6 +199,79 @@ presubmits:
         secret:
           secretName: result-aggregator
     trigger: (?m)^/test( | .* )e2e-aws-operator,?($|\s.*)
+  - agent: kubernetes
+    always_run: false
+    branches:
+    - ^release-4\.18$
+    - ^release-4\.18-
+    cluster: build06
+    context: ci/prow/e2e-aws-upgrade
+    decorate: true
+    labels:
+      ci-operator.openshift.io/cloud: aws
+      ci-operator.openshift.io/cloud-cluster-profile: aws
+      ci.openshift.io/generator: prowgen
+      pj-rehearse.openshift.io/can-be-rehearsed: "true"
+    name: pull-ci-openshift-cluster-resource-override-admission-operator-release-4.18-e2e-aws-upgrade
+    rerun_command: /test e2e-aws-upgrade
+    skip_if_only_changed: ^docs/|^\.github|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --lease-server-credentials-file=/etc/boskos/credentials
+        - --report-credentials-file=/etc/report/credentials
+        - --secret-dir=/secrets/ci-pull-credentials
+        - --target=e2e-aws-upgrade
+        command:
+        - ci-operator
+        image: ci-operator:latest
+        imagePullPolicy: Always
+        name: ""
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /etc/boskos
+          name: boskos
+          readOnly: true
+        - mountPath: /secrets/ci-pull-credentials
+          name: ci-pull-credentials
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: boskos
+        secret:
+          items:
+          - key: credentials
+            path: credentials
+          secretName: boskos-credentials
+      - name: ci-pull-credentials
+        secret:
+          secretName: ci-pull-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+    trigger: (?m)^/test( | .* )e2e-aws-upgrade,?($|\s.*)
   - agent: kubernetes
     always_run: true
     branches:
diff --git a/ci-operator/jobs/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-release-4.19-presubmits.yaml b/ci-operator/jobs/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-release-4.19-presubmits.yaml
index 44d450d36d657..a4378e709d0b3 100644
--- a/ci-operator/jobs/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-release-4.19-presubmits.yaml
+++ b/ci-operator/jobs/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-release-4.19-presubmits.yaml
@@ -199,6 +199,79 @@ presubmits:
         secret:
           secretName: result-aggregator
     trigger: (?m)^/test( | .* )e2e-aws-operator,?($|\s.*)
+  - agent: kubernetes
+    always_run: false
+    branches:
+    - ^release-4\.19$
+    - ^release-4\.19-
+    cluster: build06
+    context: ci/prow/e2e-aws-upgrade
+    decorate: true
+    labels:
+      ci-operator.openshift.io/cloud: aws
+      ci-operator.openshift.io/cloud-cluster-profile: aws
+      ci.openshift.io/generator: prowgen
+      pj-rehearse.openshift.io/can-be-rehearsed: "true"
+    name: pull-ci-openshift-cluster-resource-override-admission-operator-release-4.19-e2e-aws-upgrade
+    rerun_command: /test e2e-aws-upgrade
+    skip_if_only_changed: ^docs/|^\.github|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --lease-server-credentials-file=/etc/boskos/credentials
+        - --report-credentials-file=/etc/report/credentials
+        - --secret-dir=/secrets/ci-pull-credentials
+        - --target=e2e-aws-upgrade
+        command:
+        - ci-operator
+        image: ci-operator:latest
+        imagePullPolicy: Always
+        name: ""
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /etc/boskos
+          name: boskos
+          readOnly: true
+        - mountPath: /secrets/ci-pull-credentials
+          name: ci-pull-credentials
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: boskos
+        secret:
+          items:
+          - key: credentials
+            path: credentials
+          secretName: boskos-credentials
+      - name: ci-pull-credentials
+        secret:
+          secretName: ci-pull-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+    trigger: (?m)^/test( | .* )e2e-aws-upgrade,?($|\s.*)
   - agent: kubernetes
     always_run: true
     branches:
diff --git a/ci-operator/jobs/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-release-4.20-presubmits.yaml b/ci-operator/jobs/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-release-4.20-presubmits.yaml
index f272520393ed4..72496714ea1b1 100644
--- a/ci-operator/jobs/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-release-4.20-presubmits.yaml
+++ b/ci-operator/jobs/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-release-4.20-presubmits.yaml
@@ -199,6 +199,79 @@ presubmits:
         secret:
           secretName: result-aggregator
     trigger: (?m)^/test( | .* )e2e-aws-operator,?($|\s.*)
+  - agent: kubernetes
+    always_run: false
+    branches:
+    - ^release-4\.20$
+    - ^release-4\.20-
+    cluster: build06
+    context: ci/prow/e2e-aws-upgrade
+    decorate: true
+    labels:
+      ci-operator.openshift.io/cloud: aws
+      ci-operator.openshift.io/cloud-cluster-profile: aws
+      ci.openshift.io/generator: prowgen
+      pj-rehearse.openshift.io/can-be-rehearsed: "true"
+    name: pull-ci-openshift-cluster-resource-override-admission-operator-release-4.20-e2e-aws-upgrade
+    rerun_command: /test e2e-aws-upgrade
+    skip_if_only_changed: ^docs/|^\.github|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --lease-server-credentials-file=/etc/boskos/credentials
+        - --report-credentials-file=/etc/report/credentials
+        - --secret-dir=/secrets/ci-pull-credentials
+        - --target=e2e-aws-upgrade
+        command:
+        - ci-operator
+        image: ci-operator:latest
+        imagePullPolicy: Always
+        name: ""
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /etc/boskos
+          name: boskos
+          readOnly: true
+        - mountPath: /secrets/ci-pull-credentials
+          name: ci-pull-credentials
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: boskos
+        secret:
+          items:
+          - key: credentials
+            path: credentials
+          secretName: boskos-credentials
+      - name: ci-pull-credentials
+        secret:
+          secretName: ci-pull-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+    trigger: (?m)^/test( | .* )e2e-aws-upgrade,?($|\s.*)
   - agent: kubernetes
     always_run: true
     branches: