diff --git a/lib/embedded_ansible.rb b/lib/embedded_ansible.rb
index 423602a1447..cee44c4c5ea 100644
--- a/lib/embedded_ansible.rb
+++ b/lib/embedded_ansible.rb
@@ -11,6 +11,7 @@ class EmbeddedAnsible
   HTTP_PORT              = 54_321
   HTTPS_PORT             = 54_322
   WAIT_FOR_ANSIBLE_SLEEP = 1.second
+  TOWER_VERSION_FILE     = "/var/lib/awx/.tower_version".freeze
 
   def self.available?
     return true if MiqEnvironment::Command.is_container?
@@ -36,6 +37,10 @@ def self.configured?
     key.present? && key == File.read(SECRET_KEY_FILE)
   end
 
+  def self.upgrade?
+    local_tower_version != tower_rpm_version
+  end
+
   def self.alive?
     return false unless configured? && running?
     begin
@@ -87,7 +92,7 @@ def self.api_connection
   end
 
   def self.appliance_start
-    if configured?
+    if configured? && !upgrade?
       services.each { |service| LinuxAdmin::Service.new(service).start.enable }
     else
       configure_secret_key
@@ -229,4 +234,14 @@ def self.database_connection
     ActiveRecord::Base.connection
   end
   private_class_method :database_connection
+
+  def self.local_tower_version
+    File.read(TOWER_VERSION_FILE).strip
+  end
+  private_class_method :local_tower_version
+
+  def self.tower_rpm_version
+    LinuxAdmin::Rpm.info("ansible-tower-server")["version"]
+  end
+  private_class_method :tower_rpm_version
 end
diff --git a/spec/lib/embedded_ansible_spec.rb b/spec/lib/embedded_ansible_spec.rb
index c4bcdfdedbb..0a35139a6d0 100644
--- a/spec/lib/embedded_ansible_spec.rb
+++ b/spec/lib/embedded_ansible_spec.rb
@@ -119,8 +119,15 @@
       end
     end
 
-    describe ".start when configured" do
+    describe ".start when configured and not upgrading" do
+      let(:version_file) { Tempfile.new("tower_version") }
+
       before do
+        version_file.write("3.1.3\n")
+        version_file.close
+        stub_const("EmbeddedAnsible::TOWER_VERSION_FILE", version_file.path)
+        expect(LinuxAdmin::Rpm).to receive(:info).with("ansible-tower-server").and_return("version" => "3.1.3")
+
         stub_const("EmbeddedAnsible::WAIT_FOR_ANSIBLE_SLEEP", 0)
 
         expect(EmbeddedAnsible).to receive(:configured?).and_return true
@@ -319,6 +326,31 @@
       end
     end
 
+    describe ".start when configured and upgrading" do
+      let(:version_file) { Tempfile.new("tower_version") }
+
+      before do
+        version_file.write("3.1.2\n")
+        version_file.close
+        stub_const("EmbeddedAnsible::TOWER_VERSION_FILE", version_file.path)
+        expect(LinuxAdmin::Rpm).to receive(:info).with("ansible-tower-server").and_return("version" => "3.1.3")
+
+        expect(described_class).to receive(:configured?).and_return(true)
+        expect(described_class).to receive(:configure_secret_key)
+      end
+
+      it "runs the setup playbook" do
+        expect(described_class).to receive(:alive?).and_return(true)
+        miq_database.set_ansible_admin_authentication(:password => "adminpassword")
+        miq_database.set_ansible_rabbitmq_authentication(:userid => "rabbituser", :password => "rabbitpassword")
+        miq_database.set_ansible_database_authentication(:userid => "databaseuser", :password => "databasepassword")
+
+        expect(AwesomeSpawn).to receive(:run!).with("ansible-tower-setup", anything)
+
+        described_class.start
+      end
+    end
+
     describe ".start when not configured" do
       before do
         expect(described_class).to receive(:configured?).and_return(false)