diff --git a/roles/kubernetes/preinstall/tasks/0040-verify-settings.yml b/roles/kubernetes/preinstall/tasks/0040-verify-settings.yml
index 09fb101fb..93e0b93cf 100644
--- a/roles/kubernetes/preinstall/tasks/0040-verify-settings.yml
+++ b/roles/kubernetes/preinstall/tasks/0040-verify-settings.yml
@@ -22,7 +22,6 @@
       - not cinder_csi_plugin_version.startswith('v')
       - not cni_version.startswith('v')
       - not dnsautoscaler_version.startswith('v')
-      - not etcd_version.startswith('v')
       - not flannel_cni_version.startswith('v')
       - not flannel_version.startswith('v')
       - gateway_api_version is not defined or not gateway_api_version.startswith('v')
@@ -38,12 +37,23 @@
       - not metrics_server_version.startswith('v')
       - not multus_version.startswith('v')
       - not netcheck_version.startswith('v')
-      - not pod_infra_version.startswith('v')
       - not rbd_provisioner_version.startswith('v')
       - not runc_version.startswith('v')
       - not skopeo_version.startswith('v')
       - not yq_version.startswith('v')
 
+- name: Stop if some derived versions have a 'v' left at the start
+  # TODO: drop this task after 2.28.0 is released
+  # The 'not defined' tests are exception for applications which version in not defined
+  # in kubespray-defaults, only in their own roles.
+  assert:
+    msg: |
+      All version string used in kubespray have been normalized to not use a leading 'v'.
+      This check will be dropped in the next minor release.
+    that:
+      - not etcd_version.startswith('v')
+      - not pod_infra_version.startswith('v')
+
 - name: Stop if any host not in '--limit' does not have a fact cache
   vars:
     uncached_hosts: "{{ hostvars | dict2items | selectattr('value.ansible_default_ipv6', 'undefined') | selectattr('value.ansible_default_ipv4', 'undefined') | map(attribute='key') }}"