diff --git a/pkg/cluster/manager/deploy.go b/pkg/cluster/manager/deploy.go
index d122de5c85..ad44bbbf01 100644
--- a/pkg/cluster/manager/deploy.go
+++ b/pkg/cluster/manager/deploy.go
@@ -89,7 +89,8 @@ func (m *Manager) Deploy(
 		return err
 	}
 	if clusterSpec, ok := topo.(*spec.Specification); ok {
-		if semver.Compare(clusterVersion, "v4.0.5") < 0 &&
+		if clusterSpec.GlobalOptions.TLSEnabled &&
+			semver.Compare(clusterVersion, "v4.0.5") < 0 &&
 			len(clusterSpec.TiFlashServers) > 0 {
 			return fmt.Errorf("TiFlash %s is not supported in TLS enabled cluster", clusterVersion)
 		}
diff --git a/pkg/cluster/manager/scale_out.go b/pkg/cluster/manager/scale_out.go
index e4eb8524a1..101bf0b140 100644
--- a/pkg/cluster/manager/scale_out.go
+++ b/pkg/cluster/manager/scale_out.go
@@ -80,7 +80,8 @@ func (m *Manager) ScaleOut(
 	}
 
 	if clusterSpec, ok := topo.(*spec.Specification); ok {
-		if semver.Compare(base.Version, "v4.0.5") < 0 &&
+		if clusterSpec.GlobalOptions.TLSEnabled &&
+			semver.Compare(base.Version, "v4.0.5") < 0 &&
 			len(clusterSpec.TiFlashServers) > 0 {
 			return fmt.Errorf("TiFlash %s is not supported in TLS enabled cluster", base.Version)
 		}