diff --git a/provider-ci/internal/pkg/generate.go b/provider-ci/internal/pkg/generate.go
index 79c3db572..75c54421a 100644
--- a/provider-ci/internal/pkg/generate.go
+++ b/provider-ci/internal/pkg/generate.go
@@ -83,6 +83,7 @@ func getDeletedFiles(templateName string) []string {
 	switch templateName {
 	case "bridged-provider":
 		return []string{
+			".github/workflows/check-upstream-upgrade.yml",
 			"scripts/upstream.sh",
 			".goreleaser.yml",
 			".goreleaser.prerelease.yml",
diff --git a/provider-ci/internal/pkg/templates/bridged-provider/.github/workflows/check-upstream-upgrade.yml b/provider-ci/internal/pkg/templates/bridged-provider/.github/workflows/check-upstream-upgrade.yml
deleted file mode 100644
index 083eddf70..000000000
--- a/provider-ci/internal/pkg/templates/bridged-provider/.github/workflows/check-upstream-upgrade.yml
+++ /dev/null
@@ -1,43 +0,0 @@
-#{{- if not (eq .Config.provider "mysql" "minio") }}#
-#WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
-
-env:
-  GH_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
-jobs:
-  check_upgrade_provider:
-    name: Check for upstream provider upgrades
-    runs-on: #{{ .Config.runner.default }}#
-    steps:
-    - name: Checkout Repo
-      uses: #{{ .Config.actionVersions.checkout }}#
-        #{{- if .Config.checkoutSubmodules }}#
-      with:
-        submodules: #{{ .Config.checkoutSubmodules }}#
-    #{{- end }}#
-    - name: Setup tools
-      uses: ./.github/actions/setup-tools
-      with:
-        tools: go
-    - name: Install upgrade-provider
-      run: go install github.com/pulumi/upgrade-provider@main
-      shell: bash
-    - name: "Set up git identity: name"
-      run: git config --global user.name pulumi-bot
-      shell: bash
-    - name: "Set up git identity: email"
-      run: git config --global user.email bot@pulumi.com
-      shell: bash
-    - name: Run upgrade-provider upstream check
-      id: upstream_version
-      run: |
-        upgrade-provider "$REPO" --kind=check-upstream-version
-      env:
-        REPO: ${{ github.repository }}
-      shell: bash
-name: Check upstream upgrade
-on:
-  workflow_dispatch: {} #so we can run this manually if necessary.
-  schedule:
-    # 3 AM UTC ~ 8 PM PDT / 7 PM PST daily. Time chosen to run during off hours.
-    - cron: 0 3 * * *
-#{{ end -}}#
diff --git a/provider-ci/internal/pkg/templates/bridged-provider/.github/workflows/upgrade-provider.yml b/provider-ci/internal/pkg/templates/bridged-provider/.github/workflows/upgrade-provider.yml
index e296a4daf..0bb188853 100644
--- a/provider-ci/internal/pkg/templates/bridged-provider/.github/workflows/upgrade-provider.yml
+++ b/provider-ci/internal/pkg/templates/bridged-provider/.github/workflows/upgrade-provider.yml
@@ -1,11 +1,22 @@
 # WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
 
+name: Upgrade provider
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "The version of the upstream provider to upgrade to, without the 'v' prefix"
+        required: false
+        type: string
+  schedule:
+    # 3 AM UTC ~ 8 PM PDT / 7 PM PST daily. Time chosen to run during off hours.
+    - cron: 0 3 * * *
+
 env:
   GH_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 jobs:
   upgrade_provider:
-    if: ${{ (github.event.issue.user.login == 'pulumi-bot' && contains(github.event.issue.title, 'Upgrade terraform-provider-')) || github.event_name == 'workflow_dispatch' }}
     name: upgrade-provider
     runs-on: #{{ .Config.runner.default }}#
     steps:
@@ -31,17 +42,27 @@ jobs:
       - name: Install upgrade-provider
         run: go install github.com/pulumi/upgrade-provider@main
         shell: bash
-      - name: "Set up git identity: name"
+      - name: "Set up git identity"
         run: |
           git config --global user.name 'bot@pulumi.com'
           git config --global user.email 'bot@pulumi.com'
         shell: bash
-      - name: Run upgrade-provider
-        run: upgrade-provider "${{ github.repository }}" --kind="all" #{{ if .Config.javaGenVersion }}#--java-version="#{{ .Config.javaGenVersion }}#"#{{ end }}#
+      - name: Create issues for new upstream version
+        if: inputs.version == ''
+        id: upstream_version
+        # This step outputs `latest_version` if there is a pending upgrade
+        run: upgrade-provider "$REPO" --kind=check-upstream-version
+        env:
+          REPO: ${{ github.repository }}
+        shell: bash
+      - name: Calculate target version
+        id: target_version
+        # Prefer the manually specified version if it exists
+        # upstream_version will be empty if the provider is up-to-date
+        run: echo "version=${{ github.event.inputs.version || steps.upstream_version.outputs.latest_version }}" >> "$GITHUB_OUTPUT"
+        shell: bash
+      - name: Attempt provider upgrade
+        # Only attempt the upgrade if we have a target version
+        if: steps.target_version.outputs.version != ''
+        run: upgrade-provider "${{ github.repository }}" --kind="all" --target-version="${{ steps.target_version.outputs.version }}" #{{ if .Config.javaGenVersion }}#--java-version="#{{ .Config.javaGenVersion }}#"#{{ end }}#
         shell: bash
-name: Upgrade provider
-on:
-  issues:
-    types:
-      - opened
-  workflow_dispatch: {}
diff --git a/provider-ci/test-providers/acme/.github/workflows/check-upstream-upgrade.yml b/provider-ci/test-providers/acme/.github/workflows/check-upstream-upgrade.yml
deleted file mode 100644
index a4d997bc0..000000000
--- a/provider-ci/test-providers/acme/.github/workflows/check-upstream-upgrade.yml
+++ /dev/null
@@ -1,38 +0,0 @@
-
-#WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
-
-env:
-  GH_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
-jobs:
-  check_upgrade_provider:
-    name: Check for upstream provider upgrades
-    runs-on: ubuntu-latest
-    steps:
-    - name: Checkout Repo
-      uses: actions/checkout@v4
-    - name: Setup tools
-      uses: ./.github/actions/setup-tools
-      with:
-        tools: go
-    - name: Install upgrade-provider
-      run: go install github.com/pulumi/upgrade-provider@main
-      shell: bash
-    - name: "Set up git identity: name"
-      run: git config --global user.name pulumi-bot
-      shell: bash
-    - name: "Set up git identity: email"
-      run: git config --global user.email bot@pulumi.com
-      shell: bash
-    - name: Run upgrade-provider upstream check
-      id: upstream_version
-      run: |
-        upgrade-provider "$REPO" --kind=check-upstream-version
-      env:
-        REPO: ${{ github.repository }}
-      shell: bash
-name: Check upstream upgrade
-on:
-  workflow_dispatch: {} #so we can run this manually if necessary.
-  schedule:
-    # 3 AM UTC ~ 8 PM PDT / 7 PM PST daily. Time chosen to run during off hours.
-    - cron: 0 3 * * *
diff --git a/provider-ci/test-providers/acme/.github/workflows/upgrade-provider.yml b/provider-ci/test-providers/acme/.github/workflows/upgrade-provider.yml
index 29115ec16..7f8c62da2 100644
--- a/provider-ci/test-providers/acme/.github/workflows/upgrade-provider.yml
+++ b/provider-ci/test-providers/acme/.github/workflows/upgrade-provider.yml
@@ -1,11 +1,22 @@
 # WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
 
+name: Upgrade provider
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "The version of the upstream provider to upgrade to, without the 'v' prefix"
+        required: false
+        type: string
+  schedule:
+    # 3 AM UTC ~ 8 PM PDT / 7 PM PST daily. Time chosen to run during off hours.
+    - cron: 0 3 * * *
+
 env:
   GH_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 jobs:
   upgrade_provider:
-    if: ${{ (github.event.issue.user.login == 'pulumi-bot' && contains(github.event.issue.title, 'Upgrade terraform-provider-')) || github.event_name == 'workflow_dispatch' }}
     name: upgrade-provider
     runs-on: ubuntu-latest
     steps:
@@ -18,17 +29,27 @@ jobs:
       - name: Install upgrade-provider
         run: go install github.com/pulumi/upgrade-provider@main
         shell: bash
-      - name: "Set up git identity: name"
+      - name: "Set up git identity"
         run: |
           git config --global user.name 'bot@pulumi.com'
           git config --global user.email 'bot@pulumi.com'
         shell: bash
-      - name: Run upgrade-provider
-        run: upgrade-provider "${{ github.repository }}" --kind="all" 
+      - name: Create issues for new upstream version
+        if: inputs.version == ''
+        id: upstream_version
+        # This step outputs `latest_version` if there is a pending upgrade
+        run: upgrade-provider "$REPO" --kind=check-upstream-version
+        env:
+          REPO: ${{ github.repository }}
+        shell: bash
+      - name: Calculate target version
+        id: target_version
+        # Prefer the manually specified version if it exists
+        # upstream_version will be empty if the provider is up-to-date
+        run: echo "version=${{ github.event.inputs.version || steps.upstream_version.outputs.latest_version }}" >> "$GITHUB_OUTPUT"
+        shell: bash
+      - name: Attempt provider upgrade
+        # Only attempt the upgrade if we have a target version
+        if: steps.target_version.outputs.version != ''
+        run: upgrade-provider "${{ github.repository }}" --kind="all" --target-version="${{ steps.target_version.outputs.version }}" 
         shell: bash
-name: Upgrade provider
-on:
-  issues:
-    types:
-      - opened
-  workflow_dispatch: {}
diff --git a/provider-ci/test-providers/aws/.github/workflows/check-upstream-upgrade.yml b/provider-ci/test-providers/aws/.github/workflows/check-upstream-upgrade.yml
deleted file mode 100644
index d79f5127e..000000000
--- a/provider-ci/test-providers/aws/.github/workflows/check-upstream-upgrade.yml
+++ /dev/null
@@ -1,40 +0,0 @@
-
-#WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
-
-env:
-  GH_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
-jobs:
-  check_upgrade_provider:
-    name: Check for upstream provider upgrades
-    runs-on: ubuntu-latest
-    steps:
-    - name: Checkout Repo
-      uses: actions/checkout@v4
-      with:
-        submodules: true
-    - name: Setup tools
-      uses: ./.github/actions/setup-tools
-      with:
-        tools: go
-    - name: Install upgrade-provider
-      run: go install github.com/pulumi/upgrade-provider@main
-      shell: bash
-    - name: "Set up git identity: name"
-      run: git config --global user.name pulumi-bot
-      shell: bash
-    - name: "Set up git identity: email"
-      run: git config --global user.email bot@pulumi.com
-      shell: bash
-    - name: Run upgrade-provider upstream check
-      id: upstream_version
-      run: |
-        upgrade-provider "$REPO" --kind=check-upstream-version
-      env:
-        REPO: ${{ github.repository }}
-      shell: bash
-name: Check upstream upgrade
-on:
-  workflow_dispatch: {} #so we can run this manually if necessary.
-  schedule:
-    # 3 AM UTC ~ 8 PM PDT / 7 PM PST daily. Time chosen to run during off hours.
-    - cron: 0 3 * * *
diff --git a/provider-ci/test-providers/aws/.github/workflows/upgrade-provider.yml b/provider-ci/test-providers/aws/.github/workflows/upgrade-provider.yml
index cc067e44b..f77e7349d 100644
--- a/provider-ci/test-providers/aws/.github/workflows/upgrade-provider.yml
+++ b/provider-ci/test-providers/aws/.github/workflows/upgrade-provider.yml
@@ -1,11 +1,22 @@
 # WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
 
+name: Upgrade provider
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "The version of the upstream provider to upgrade to, without the 'v' prefix"
+        required: false
+        type: string
+  schedule:
+    # 3 AM UTC ~ 8 PM PDT / 7 PM PST daily. Time chosen to run during off hours.
+    - cron: 0 3 * * *
+
 env:
   GH_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 jobs:
   upgrade_provider:
-    if: ${{ (github.event.issue.user.login == 'pulumi-bot' && contains(github.event.issue.title, 'Upgrade terraform-provider-')) || github.event_name == 'workflow_dispatch' }}
     name: upgrade-provider
     runs-on: ubuntu-latest
     steps:
@@ -27,17 +38,27 @@ jobs:
       - name: Install upgrade-provider
         run: go install github.com/pulumi/upgrade-provider@main
         shell: bash
-      - name: "Set up git identity: name"
+      - name: "Set up git identity"
         run: |
           git config --global user.name 'bot@pulumi.com'
           git config --global user.email 'bot@pulumi.com'
         shell: bash
-      - name: Run upgrade-provider
-        run: upgrade-provider "${{ github.repository }}" --kind="all" 
+      - name: Create issues for new upstream version
+        if: inputs.version == ''
+        id: upstream_version
+        # This step outputs `latest_version` if there is a pending upgrade
+        run: upgrade-provider "$REPO" --kind=check-upstream-version
+        env:
+          REPO: ${{ github.repository }}
+        shell: bash
+      - name: Calculate target version
+        id: target_version
+        # Prefer the manually specified version if it exists
+        # upstream_version will be empty if the provider is up-to-date
+        run: echo "version=${{ github.event.inputs.version || steps.upstream_version.outputs.latest_version }}" >> "$GITHUB_OUTPUT"
+        shell: bash
+      - name: Attempt provider upgrade
+        # Only attempt the upgrade if we have a target version
+        if: steps.target_version.outputs.version != ''
+        run: upgrade-provider "${{ github.repository }}" --kind="all" --target-version="${{ steps.target_version.outputs.version }}" 
         shell: bash
-name: Upgrade provider
-on:
-  issues:
-    types:
-      - opened
-  workflow_dispatch: {}
diff --git a/provider-ci/test-providers/cloudflare/.github/workflows/check-upstream-upgrade.yml b/provider-ci/test-providers/cloudflare/.github/workflows/check-upstream-upgrade.yml
deleted file mode 100644
index a4d997bc0..000000000
--- a/provider-ci/test-providers/cloudflare/.github/workflows/check-upstream-upgrade.yml
+++ /dev/null
@@ -1,38 +0,0 @@
-
-#WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
-
-env:
-  GH_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
-jobs:
-  check_upgrade_provider:
-    name: Check for upstream provider upgrades
-    runs-on: ubuntu-latest
-    steps:
-    - name: Checkout Repo
-      uses: actions/checkout@v4
-    - name: Setup tools
-      uses: ./.github/actions/setup-tools
-      with:
-        tools: go
-    - name: Install upgrade-provider
-      run: go install github.com/pulumi/upgrade-provider@main
-      shell: bash
-    - name: "Set up git identity: name"
-      run: git config --global user.name pulumi-bot
-      shell: bash
-    - name: "Set up git identity: email"
-      run: git config --global user.email bot@pulumi.com
-      shell: bash
-    - name: Run upgrade-provider upstream check
-      id: upstream_version
-      run: |
-        upgrade-provider "$REPO" --kind=check-upstream-version
-      env:
-        REPO: ${{ github.repository }}
-      shell: bash
-name: Check upstream upgrade
-on:
-  workflow_dispatch: {} #so we can run this manually if necessary.
-  schedule:
-    # 3 AM UTC ~ 8 PM PDT / 7 PM PST daily. Time chosen to run during off hours.
-    - cron: 0 3 * * *
diff --git a/provider-ci/test-providers/cloudflare/.github/workflows/upgrade-provider.yml b/provider-ci/test-providers/cloudflare/.github/workflows/upgrade-provider.yml
index 29115ec16..7f8c62da2 100644
--- a/provider-ci/test-providers/cloudflare/.github/workflows/upgrade-provider.yml
+++ b/provider-ci/test-providers/cloudflare/.github/workflows/upgrade-provider.yml
@@ -1,11 +1,22 @@
 # WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
 
+name: Upgrade provider
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "The version of the upstream provider to upgrade to, without the 'v' prefix"
+        required: false
+        type: string
+  schedule:
+    # 3 AM UTC ~ 8 PM PDT / 7 PM PST daily. Time chosen to run during off hours.
+    - cron: 0 3 * * *
+
 env:
   GH_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 jobs:
   upgrade_provider:
-    if: ${{ (github.event.issue.user.login == 'pulumi-bot' && contains(github.event.issue.title, 'Upgrade terraform-provider-')) || github.event_name == 'workflow_dispatch' }}
     name: upgrade-provider
     runs-on: ubuntu-latest
     steps:
@@ -18,17 +29,27 @@ jobs:
       - name: Install upgrade-provider
         run: go install github.com/pulumi/upgrade-provider@main
         shell: bash
-      - name: "Set up git identity: name"
+      - name: "Set up git identity"
         run: |
           git config --global user.name 'bot@pulumi.com'
           git config --global user.email 'bot@pulumi.com'
         shell: bash
-      - name: Run upgrade-provider
-        run: upgrade-provider "${{ github.repository }}" --kind="all" 
+      - name: Create issues for new upstream version
+        if: inputs.version == ''
+        id: upstream_version
+        # This step outputs `latest_version` if there is a pending upgrade
+        run: upgrade-provider "$REPO" --kind=check-upstream-version
+        env:
+          REPO: ${{ github.repository }}
+        shell: bash
+      - name: Calculate target version
+        id: target_version
+        # Prefer the manually specified version if it exists
+        # upstream_version will be empty if the provider is up-to-date
+        run: echo "version=${{ github.event.inputs.version || steps.upstream_version.outputs.latest_version }}" >> "$GITHUB_OUTPUT"
+        shell: bash
+      - name: Attempt provider upgrade
+        # Only attempt the upgrade if we have a target version
+        if: steps.target_version.outputs.version != ''
+        run: upgrade-provider "${{ github.repository }}" --kind="all" --target-version="${{ steps.target_version.outputs.version }}" 
         shell: bash
-name: Upgrade provider
-on:
-  issues:
-    types:
-      - opened
-  workflow_dispatch: {}
diff --git a/provider-ci/test-providers/docker/.github/workflows/check-upstream-upgrade.yml b/provider-ci/test-providers/docker/.github/workflows/check-upstream-upgrade.yml
deleted file mode 100644
index a4d997bc0..000000000
--- a/provider-ci/test-providers/docker/.github/workflows/check-upstream-upgrade.yml
+++ /dev/null
@@ -1,38 +0,0 @@
-
-#WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
-
-env:
-  GH_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
-jobs:
-  check_upgrade_provider:
-    name: Check for upstream provider upgrades
-    runs-on: ubuntu-latest
-    steps:
-    - name: Checkout Repo
-      uses: actions/checkout@v4
-    - name: Setup tools
-      uses: ./.github/actions/setup-tools
-      with:
-        tools: go
-    - name: Install upgrade-provider
-      run: go install github.com/pulumi/upgrade-provider@main
-      shell: bash
-    - name: "Set up git identity: name"
-      run: git config --global user.name pulumi-bot
-      shell: bash
-    - name: "Set up git identity: email"
-      run: git config --global user.email bot@pulumi.com
-      shell: bash
-    - name: Run upgrade-provider upstream check
-      id: upstream_version
-      run: |
-        upgrade-provider "$REPO" --kind=check-upstream-version
-      env:
-        REPO: ${{ github.repository }}
-      shell: bash
-name: Check upstream upgrade
-on:
-  workflow_dispatch: {} #so we can run this manually if necessary.
-  schedule:
-    # 3 AM UTC ~ 8 PM PDT / 7 PM PST daily. Time chosen to run during off hours.
-    - cron: 0 3 * * *
diff --git a/provider-ci/test-providers/docker/.github/workflows/upgrade-provider.yml b/provider-ci/test-providers/docker/.github/workflows/upgrade-provider.yml
index 29115ec16..7f8c62da2 100644
--- a/provider-ci/test-providers/docker/.github/workflows/upgrade-provider.yml
+++ b/provider-ci/test-providers/docker/.github/workflows/upgrade-provider.yml
@@ -1,11 +1,22 @@
 # WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
 
+name: Upgrade provider
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "The version of the upstream provider to upgrade to, without the 'v' prefix"
+        required: false
+        type: string
+  schedule:
+    # 3 AM UTC ~ 8 PM PDT / 7 PM PST daily. Time chosen to run during off hours.
+    - cron: 0 3 * * *
+
 env:
   GH_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 jobs:
   upgrade_provider:
-    if: ${{ (github.event.issue.user.login == 'pulumi-bot' && contains(github.event.issue.title, 'Upgrade terraform-provider-')) || github.event_name == 'workflow_dispatch' }}
     name: upgrade-provider
     runs-on: ubuntu-latest
     steps:
@@ -18,17 +29,27 @@ jobs:
       - name: Install upgrade-provider
         run: go install github.com/pulumi/upgrade-provider@main
         shell: bash
-      - name: "Set up git identity: name"
+      - name: "Set up git identity"
         run: |
           git config --global user.name 'bot@pulumi.com'
           git config --global user.email 'bot@pulumi.com'
         shell: bash
-      - name: Run upgrade-provider
-        run: upgrade-provider "${{ github.repository }}" --kind="all" 
+      - name: Create issues for new upstream version
+        if: inputs.version == ''
+        id: upstream_version
+        # This step outputs `latest_version` if there is a pending upgrade
+        run: upgrade-provider "$REPO" --kind=check-upstream-version
+        env:
+          REPO: ${{ github.repository }}
+        shell: bash
+      - name: Calculate target version
+        id: target_version
+        # Prefer the manually specified version if it exists
+        # upstream_version will be empty if the provider is up-to-date
+        run: echo "version=${{ github.event.inputs.version || steps.upstream_version.outputs.latest_version }}" >> "$GITHUB_OUTPUT"
+        shell: bash
+      - name: Attempt provider upgrade
+        # Only attempt the upgrade if we have a target version
+        if: steps.target_version.outputs.version != ''
+        run: upgrade-provider "${{ github.repository }}" --kind="all" --target-version="${{ steps.target_version.outputs.version }}" 
         shell: bash
-name: Upgrade provider
-on:
-  issues:
-    types:
-      - opened
-  workflow_dispatch: {}