diff --git a/pkg/session/bootstrap.go b/pkg/session/bootstrap.go
index 060e57c1cac24..02b56ca664765 100644
--- a/pkg/session/bootstrap.go
+++ b/pkg/session/bootstrap.go
@@ -3148,7 +3148,7 @@ func upgradeToVer214(s sessiontypes.Session, ver int64) {
 	if ver >= version214 {
 		return
 	}
-	mustExecute(s, "DELETE FROM mysql.global_variables where VARIABLE_NAME like 'validate_password_%'")
+	mustExecute(s, `DELETE FROM mysql.global_variables WHERE variable_name LIKE 'validate\_password\_%'`)
 
 	initGlobalVariableIfNotExists(s, variable.ValidatePasswordCheckUserName, variable.On)
 	initGlobalVariableIfNotExists(s, variable.ValidatePasswordSpecialCharCount, "1")
diff --git a/pkg/session/bootstraptest/BUILD.bazel b/pkg/session/bootstraptest/BUILD.bazel
index f770b484eb0d5..57dea5ae95be1 100644
--- a/pkg/session/bootstraptest/BUILD.bazel
+++ b/pkg/session/bootstraptest/BUILD.bazel
@@ -8,7 +8,7 @@ go_test(
         "main_test.go",
     ],
     flaky = True,
-    shard_count = 12,
+    shard_count = 13,
     deps = [
         "//pkg/config",
         "//pkg/ddl",
@@ -21,6 +21,7 @@ go_test(
         "//pkg/session",  #keep
         "//pkg/session/types",
         "//pkg/sessionctx",
+        "//pkg/sessionctx/variable",
         "//pkg/testkit",  #keep
         "//pkg/testkit/testfailpoint",
         "//pkg/testkit/testmain",
diff --git a/pkg/session/bootstraptest/bootstrap_upgrade_test.go b/pkg/session/bootstraptest/bootstrap_upgrade_test.go
index dd1e5a2aea677..4a742e096acd2 100644
--- a/pkg/session/bootstraptest/bootstrap_upgrade_test.go
+++ b/pkg/session/bootstraptest/bootstrap_upgrade_test.go
@@ -35,6 +35,7 @@ import (
 	"github.com/pingcap/tidb/pkg/session"
 	sessiontypes "github.com/pingcap/tidb/pkg/session/types"
 	"github.com/pingcap/tidb/pkg/sessionctx"
+	"github.com/pingcap/tidb/pkg/sessionctx/variable"
 	"github.com/pingcap/tidb/pkg/testkit"
 	"github.com/pingcap/tidb/pkg/testkit/testfailpoint"
 	tidbutil "github.com/pingcap/tidb/pkg/util"
@@ -243,6 +244,33 @@ func TestUpgradeVersion75(t *testing.T) {
 	require.Equal(t, "char(255)", strings.ToLower(row.GetString(1)))
 }
 
+func TestUpgradeVersion213(t *testing.T) {
+	store := testkit.CreateMockStore(t)
+
+	tk := testkit.NewTestKit(t, store)
+	ver, err := session.GetBootstrapVersion(tk.Session())
+	require.NoError(t, err)
+	require.Equal(t, session.CurrentBootstrapVersion, ver)
+
+	tk.MustQuery(`SELECT * FROM mysql.global_variables WHERE variable_name LIKE 'validate\_password\_%'`).Check(testkit.Rows())
+	tcs := []struct {
+		varName string
+		varVal  string
+	}{
+		{variable.ValidatePasswordCheckUserName, variable.On},
+		{variable.ValidatePasswordSpecialCharCount, "1"},
+		{variable.ValidatePasswordLength, "8"},
+		{variable.ValidatePasswordNumberCount, "1"},
+		{variable.ValidatePasswordMixedCaseCount, "1"},
+		{variable.ValidatePasswordPolicy, "MEDIUM"},
+		{variable.ValidatePasswordEnable, variable.Off},
+		{variable.ValidatePasswordDictionary, ""},
+	}
+	for _, tc := range tcs {
+		tk.MustQuery(`SELECT variable_value FROM mysql.global_variables WHERE variable_name = ?`, tc.varName).Check(testkit.Rows(tc.varVal))
+	}
+}
+
 func TestUpgradeVersionMockLatest(t *testing.T) {
 	mock := true
 	session.WithMockUpgrade = &mock