diff --git a/manila/share/drivers/netapp/dataontap/client/client_cmode.py b/manila/share/drivers/netapp/dataontap/client/client_cmode.py
index 52afe0f23b..0eab65d8b1 100644
--- a/manila/share/drivers/netapp/dataontap/client/client_cmode.py
+++ b/manila/share/drivers/netapp/dataontap/client/client_cmode.py
@@ -1827,13 +1827,7 @@ def _enable_nfs_protocols(self, versions, method='create',
                               extra_config=None):
         """Set the enabled NFS protocol versions."""
         nfs3 = 'true' if 'nfs3' in versions else 'false'
-        # SAPCC absence of 'nfs4.0' should not equal 'false'
-        # instead it should mean:
-        #   don't touch existing value for existing vservers
-        #   and set the default value ('false' for ONTAP 9.7 and newer)
-        #   for new vservers
-        # Change back to upstream once all vservers have nfs4.0 disabled!
-        # nfs40 = 'true' if 'nfs4.0' in versions else 'false'
+        nfs40 = 'true' if 'nfs4.0' in versions else 'false'
         nfs41 = 'true' if 'nfs4.1' in versions else 'false'
 
         nfs_service_modify_args = {
@@ -1845,15 +1839,21 @@ def _enable_nfs_protocols(self, versions, method='create',
             'enable-ejukebox': 'false',
             'is-vstorage-enabled': 'true',
         }
+        # below options are dangerous to change on existing vservers:
+        # e.g. clients may lose connections or remount is required.
+        # absence of those options on method 'update' means to not touch them
+        # e.g. during ensure runs
         if method == 'create':
             flexgroup_opts = {
                 'is-nfsv3-64bit-identifiers-enabled': 'true',   # default false
                 'is-nfsv4-64bit-identifiers-enabled': 'true',   # default true
             }
             nfs_service_modify_args.update(flexgroup_opts)
+            version_opts = {
+                'is-nfsv40-enabled': nfs40,
+            }
+            nfs_service_modify_args.update(version_opts)
 
-        if 'nfs4.0' in versions:
-            nfs_service_modify_args['is-nfsv40-enabled'] = 'true'
         if 'nfs4.1' in versions:
             nfs41_opts = {
                 # 'is-nfsv41-pnfs-enabled': 'false',               # default false, use default on new vservers, don't touch old vservers  # noqa: E501
diff --git a/manila/tests/share/drivers/netapp/dataontap/client/test_client_cmode.py b/manila/tests/share/drivers/netapp/dataontap/client/test_client_cmode.py
index 1fb78eb185..e5b8c29dee 100644
--- a/manila/tests/share/drivers/netapp/dataontap/client/test_client_cmode.py
+++ b/manila/tests/share/drivers/netapp/dataontap/client/test_client_cmode.py
@@ -2647,8 +2647,6 @@ def test_enable_nfs_protocols(self, v3, v40, v41, method, extra):
             'is-vstorage-enabled': 'true',
         }
 
-        if v40:
-            nfs_service_modify_args['is-nfsv40-enabled'] = 'true'
         if v41:
             nfs41_opts = {
                 'is-nfsv41-acl-enabled': 'false',
@@ -2664,6 +2662,8 @@ def test_enable_nfs_protocols(self, v3, v40, v41, method, extra):
                 'is-nfsv4-64bit-identifiers-enabled': 'true',
             }
             nfs_service_modify_args.update(flexgroup_opts)
+            v40_enabled = 'true' if v40 else 'false'
+            nfs_service_modify_args['is-nfsv40-enabled'] = v40_enabled
 
         if extra:
             nfs_service_modify_args.update(extra)