diff --git a/pkg/template/engine.go b/pkg/template/engine.go
index be7298fb0..3f1c22f31 100644
--- a/pkg/template/engine.go
+++ b/pkg/template/engine.go
@@ -27,7 +27,10 @@ type ExecFunc func(tpl, data map[string][]byte, scope esapi.TemplateScope, targe
 
 func EngineForVersion(version esapi.TemplateEngineVersion) (ExecFunc, error) {
 	switch version {
-	case esapi.TemplateEngineV1:
+	// NOTE: the version can be empty if the ExternalSecret was created with version 0.4.3 or earlier,
+	//       all versions after this will default to "v1" (for v1alpha1 ES) or "v2" (for v1beta1 ES).
+	//       so if we encounter an empty version, we must default to the v1 engine.
+	case esapi.TemplateEngineV1, "":
 		return v1.Execute, nil
 	case esapi.TemplateEngineV2:
 		return v2.Execute, nil