diff --git a/.github/workflows/kubernetes-tests.yml b/.github/workflows/kubernetes-tests.yml
index 73d8376c10f..05e808cc64a 100644
--- a/.github/workflows/kubernetes-tests.yml
+++ b/.github/workflows/kubernetes-tests.yml
@@ -288,6 +288,36 @@ jobs:
       - name: Tenant upgrade test on Kind
         run: |
           "${GITHUB_WORKSPACE}/testing/deploy-tenant-upgrade.sh"
+  test-tenant-hotfix-update:
+    timeout-minutes: 30
+    runs-on: ${{ matrix.os }}
+    needs:
+      - operator
+    strategy:
+      matrix:
+        go-version: [ 1.22.x ]
+        os: [ ubuntu-latest ]
+
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-go@v4
+        with:
+          go-version: ${{ matrix.go-version }}
+      - uses: actions/cache@v3
+        name: Operator Binary Cache
+        with:
+          path: |
+            ./minio-operator
+          key: ${{ runner.os }}-binary-${{ github.run_id }}
+      - uses: actions/cache@v3
+        name: Operator Sidecar Binary Cache
+        with:
+          path: |
+            ./sidecar/minio-operator-sidecar
+          key: ${{ runner.os }}-sidecar-binary-${{ github.run_id }}
+      - name: Tenant upgrade to hotfix version
+        run: |
+          "${GITHUB_WORKSPACE}/testing/tenant-hotfix-update.sh" "quay.io/minio/minio:RELEASE.2024-02-04T22-36-13Z" "quay.io/minio/minio:RELEASE.2024-02-04T22-36-13Z.hotfix.c40028f8f"
   test-kes:
     timeout-minutes: 30
     runs-on: ${{ matrix.os }}
diff --git a/shared-functions/shared-code.sh b/shared-functions/shared-code.sh
index cdb5405f57b..93d365c6a2a 100755
--- a/shared-functions/shared-code.sh
+++ b/shared-functions/shared-code.sh
@@ -65,3 +65,46 @@ function wait_for_resource_field_selector() {
     --field-selector $fieldselector \
     --timeout="$timeout"
 }
+
+# usage: wait_resource_status <namespace> <resourcetype> <resourcename> [<timeout>]
+function wait_resource_status() {
+	# This function will wait until the resource has a status field
+	# wait_resource_status ns-1 Tenant my-tenant
+	# wait_resource_status ns-1 Tenant my-tenant 1200
+
+	local namespace=$1
+	local resourcetype=$2
+	local resourcename=$3
+
+	# Timeout in seconds
+	if [ $# -ge 4 ]; then
+		TIMEOUT=$4
+	else
+		TIMEOUT=600
+	fi
+
+	START_TIME=$(date +%s)
+	# Interval in seconds between checks
+	INTERVAL=10
+
+	echo -e "${BLUE}Waiting for $resourcetype status to be created (${TIMEOUT}s timeout)${NC}"
+	while true; do
+		if kubectl get "$resourcetype" -n "$namespace" "$resourcename" -ojson | jq -e '.status' >/dev/null 2>&1; then
+			echo -e "${CHECK}$resourcetype/$resourcename status found."
+			break
+		else
+			echo "$resourcetype/$resourcename status not found, waiting for $INTERVAL seconds."
+			sleep $INTERVAL
+		fi
+
+		# Check timeout
+		CURRENT_TIME=$(date +%s)
+		# shellcheck disable=SC2004
+		ELAPSED_TIME=$(($CURRENT_TIME - $START_TIME))
+
+		if [ "$ELAPSED_TIME" -ge "$TIMEOUT" ]; then
+			echo "Timeout waiting for $resourcetype/$resourcename to be created."
+			exit 1
+		fi
+	done
+}
\ No newline at end of file
diff --git a/testing/common.sh b/testing/common.sh
index 684d2cf2708..c260032db9f 100644
--- a/testing/common.sh
+++ b/testing/common.sh
@@ -614,6 +614,8 @@ function install_operator() {
     try kubectl -n minio-operator set image deployment/console console="$TAG"
     try kubectl -n minio-operator set env deployment/minio-operator OPERATOR_SIDECAR_IMAGE="$SIDECAR_TAG"
 
+    try kubectl -n minio-operator rollout status deployment/minio-operator
+
     echo "key, value for pod selector in kustomize test"
     key=name
     value=minio-operator
@@ -714,13 +716,15 @@ function check_tenant_status() {
     echo "No third argument provided, using default key"
   fi
 
+  wait_resource_status $1 Tenant $2 600
+
   wait_for_resource $1 $value $key
 
   echo "Waiting for tenant to be Initialized"
 
   condition=jsonpath='{.status.currentState}'=Initialized
   selector="metadata.name=$2"
-  try wait_for_resource_field_selector "$1" tenant $condition "$selector" 600s
+  try wait_for_resource_field_selector "$1" tenant $condition "$selector" 1200s
 
   if [ $# -ge 4 ]; then
     echo "Fourth argument provided, then get secrets from helm"
@@ -758,6 +762,10 @@ function check_tenant_status() {
 
     # Retrieve the logs
     kubectl logs admin-mc -n tenant-certmanager
+
+		echo "removing the admin-mc pod"
+	  try kubectl delete pod admin-mc -n tenant-certmanager
+
   else
     try kubectl run --restart=Never admin-mc --image quay.io/minio/mc \
       --env="MC_HOST_minio=https://${USER}:${PASSWORD}@minio.${1}.svc.cluster.local" \
@@ -768,6 +776,10 @@ function check_tenant_status() {
 
     # Retrieve the logs
     kubectl logs admin-mc
+
+		echo "removing the admin-mc pod"
+		try kubectl delete pod admin-mc
+
   fi
 
   echo "Done."
diff --git a/testing/tenant-hotfix-update.sh b/testing/tenant-hotfix-update.sh
new file mode 100755
index 00000000000..182496bbe52
--- /dev/null
+++ b/testing/tenant-hotfix-update.sh
@@ -0,0 +1,138 @@
+#!/usr/bin/env bash
+# Copyright (C) 2024, MinIO, Inc.
+#
+# This code is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License, version 3,
+# as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License, version 3,
+# along with this program.  If not, see <http://www.gnu.org/licenses/>
+
+# This script requires: kubectl, kind
+
+SCRIPT_DIR=$(dirname "$0")
+
+export SCRIPT_DIR
+
+source "${SCRIPT_DIR}/common.sh"
+
+lower_version="$1"
+hotfix_version="$2"
+namespace="tenant-lite"
+tenant="myminio"
+bucket="data"
+dummy="dummy.data"
+localport="9000"
+alias="minios3"
+
+# Announce test
+function announce_test() {
+  local lower_text
+  local hotfix_version_text
+  if [ -n "$lower_version" ] 
+  then 
+    lower_text=$lower_version; 
+  else 
+    echo "missing MinIO version"
+    exit 1
+  fi
+
+  if [ -n "$hotfix_version" ] 
+  then 
+    hotfix_version_text=$hotfix_version;
+  else 
+    echo "missing lower version"
+		exit 1
+  fi
+
+  echo "## Testing upgrade of Tenant from version $lower_text to $hotfix_version_text ##"
+}
+
+# Preparing tenant for bucket manipulation
+# shellcheck disable=SC2317
+function bootstrap_tenant() {
+  port_forward $namespace $tenant minio $localport
+
+  # Obtain root credentials
+  TENANT_CONFIG_SECRET=$(kubectl -n $namespace get tenants $tenant -o jsonpath="{.spec.configuration.name}")
+  USER=$(kubectl -n $namespace get secrets "$TENANT_CONFIG_SECRET" -o go-template='{{index .data "config.env"|base64decode }}' | grep 'export MINIO_ROOT_USER="' | sed -e 's/export MINIO_ROOT_USER="//g' | sed -e 's/"//g')
+  PASSWORD=$(kubectl -n $namespace get secrets "$TENANT_CONFIG_SECRET" -o go-template='{{index .data "config.env"|base64decode }}' | grep 'export MINIO_ROOT_PASSWORD="' | sed -e 's/export MINIO_ROOT_PASSWORD="//g' | sed -e 's/"//g')
+
+  echo "Creating alias with user ${USER}"
+  mc alias set $alias https://localhost:$localport ${USER} ${PASSWORD} --insecure
+
+  echo "Creating bucket on tenant"
+  mc mb $alias/$bucket --insecure
+}
+
+# Upload dummy data to tenant bucket
+function upload_dummy_data() {
+  port_forward $namespace $tenant minio $localport
+
+  echo "Uploading dummy data to tenant bucket"
+  cp ${SCRIPT_DIR}/tenant-hotfix-update.sh ${SCRIPT_DIR}/$dummy
+  mc cp ${SCRIPT_DIR}/$dummy $alias/$bucket/$dummy --insecure
+}
+
+# Download dummy data from tenant bucket
+function download_dummy_data() {
+  port_forward $namespace $tenant minio $localport
+
+  echo "Download dummy data from tenant bucket"
+  mc cp $alias/$bucket/$dummy ${SCRIPT_DIR}/$dummy --insecure
+
+  if cmp "${SCRIPT_DIR}/tenant-hotfix-update.sh" "${SCRIPT_DIR}/$dummy"; then
+    echo "Tenant hotfix update test complete; no issue found"
+  else
+    echo "Tenant hotfix update failed"
+    try false
+  fi
+}
+
+function install_tenant_with_image() {
+	minio_image="$1"
+	if [ -z "$1" ]
+	then
+		echo "MinIO version is not set"
+		exit 1
+	fi
+	kustomize build "${SCRIPT_DIR}/../examples/kustomization/tenant-lite" > tenant-lite.yaml
+	yq -i e "select(.kind == \"Tenant\").spec.image = \"${minio_image}\"" tenant-lite.yaml
+
+	try kubectl apply -f tenant-lite.yaml
+}
+
+function main() {
+  announce_test
+
+  destroy_kind
+
+  setup_kind
+
+  install_operator
+
+  echo "Installing tenant with Image: $lower_version"
+
+  install_tenant_with_image "$lower_version"
+
+  check_tenant_status tenant-lite myminio
+
+  bootstrap_tenant
+
+  upload_dummy_data
+
+  install_tenant_with_image "$hotfix_version"
+  
+  check_tenant_status tenant-lite myminio
+
+  download_dummy_data
+
+  destroy_kind
+}
+
+main "$@"