diff --git a/lib/private/Updater.php b/lib/private/Updater.php
index 0a6d9c9a31d..609e965bfad 100644
--- a/lib/private/Updater.php
+++ b/lib/private/Updater.php
@@ -183,6 +183,18 @@ class Updater extends BasicEmitter {
 		return implode('.', $OC_VersionCanBeUpgradedFrom);
 	}
 
+	/**
+	 * Return vendor from which this version was published
+	 *
+	 * @return string Get the vendor
+	 */
+	private function getVendor() {
+		// this should really be a JSON file
+		require \OC::$SERVERROOT . '/version.php';
+		/** @var string $vendor */
+		return (string) $vendor;
+	}
+
 	/**
 	 * Whether an upgrade to a specified version is possible
 	 * @param string $oldVersion
@@ -191,8 +203,22 @@ class Updater extends BasicEmitter {
 	 * @return bool
 	 */
 	public function isUpgradePossible($oldVersion, $newVersion, $allowedPreviousVersion) {
-		return (version_compare($allowedPreviousVersion, $oldVersion, '<=')
+		$allowedUpgrade = (version_compare($allowedPreviousVersion, $oldVersion, '<=')
 			&& (version_compare($oldVersion, $newVersion, '<=') || $this->config->getSystemValue('debug', false)));
+
+		if ($allowedUpgrade) {
+			return $allowedUpgrade;
+		}
+
+		// Upgrade not allowed, someone switching vendor?
+		if ($this->getVendor() !== $this->config->getAppValue('core', 'vendor', '')) {
+			$oldVersion = explode('.', $oldVersion);
+			$newVersion = explode('.', $newVersion);
+
+			return $oldVersion[0] === $newVersion[0] && $oldVersion[1] === $newVersion[1];
+		}
+
+		return false;
 	}
 
 	/**
@@ -279,6 +305,7 @@ class Updater extends BasicEmitter {
 
 			// only set the final version if everything went well
 			$this->config->setSystemValue('version', implode('.', \OCP\Util::getVersion()));
+			$this->config->setAppValue('core', 'vendor', $this->getVendor());
 		}
 	}
 
diff --git a/lib/private/legacy/app.php b/lib/private/legacy/app.php
index 4cfa68cff2d..b0f28498ff7 100644
--- a/lib/private/legacy/app.php
+++ b/lib/private/legacy/app.php
@@ -989,7 +989,7 @@ class OC_App {
 		$currentVersion = OC_App::getAppVersion($app);
 		if ($currentVersion && isset($versions[$app])) {
 			$installedVersion = $versions[$app];
-			if (version_compare($currentVersion, $installedVersion, '>')) {
+			if (!version_compare($currentVersion, $installedVersion, '=')) {
 				return true;
 			}
 		}
diff --git a/tests/lib/UpdaterTest.php b/tests/lib/UpdaterTest.php
index 643a18cc714..e45a9f08243 100644
--- a/tests/lib/UpdaterTest.php
+++ b/tests/lib/UpdaterTest.php
@@ -137,6 +137,12 @@ class UpdaterTest extends \Test\TestCase {
 			['8.1.0.0', '8.2.0.0', '8.1', true, true],
 			['8.2.0.1', '8.2.0.1', '8.1', true, true],
 			['8.3.0.0', '8.2.0.0', '8.1', true, true],
+
+			// Downgrade of maintenance
+			['9.0.53.0', '9.0.4.0', '8.1', false, false, 'nextcloud'],
+			// with vendor switch
+			['9.0.53.0', '9.0.4.0', '8.1', true, false, ''],
+			['9.0.53.0', '9.0.4.0', '8.1', true, false, 'owncloud'],
 		];
 	}
 
@@ -148,12 +154,17 @@ class UpdaterTest extends \Test\TestCase {
 	 * @param string $allowedVersion
 	 * @param bool $result
 	 * @param bool $debug
+	 * @param string $vendor
 	 */
-	public function testIsUpgradePossible($oldVersion, $newVersion, $allowedVersion, $result, $debug = false) {
+	public function testIsUpgradePossible($oldVersion, $newVersion, $allowedVersion, $result, $debug = false, $vendor = 'nextcloud') {
 		$this->config->expects($this->any())
 			->method('getSystemValue')
 			->with('debug', false)
 			->willReturn($debug);
+		$this->config->expects($this->any())
+			->method('getAppValue')
+			->with('core', 'vendor', '')
+			->willReturn($vendor);
 
 		$this->assertSame($result, $this->updater->isUpgradePossible($oldVersion, $newVersion, $allowedVersion));
 	}
diff --git a/version.php b/version.php
index 562dda0a792..62adec076bb 100644
--- a/version.php
+++ b/version.php
@@ -38,3 +38,5 @@ $OC_Channel = 'git';
 // The build number
 $OC_Build = '';
 
+// Vendor of this package
+$vendor = 'nextcloud';