diff --git a/.travis.yml b/.travis.yml
index 4a06de275..eb6f4b92f 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -32,6 +32,7 @@ before_install:
 
 before_script:
   - export CV=$(source build.env ; echo ${CEPH_VERSION})
+  - test -z "${CV}" || export GO_TAGS="-tags=${CV}"
   - curl https://download.ceph.com/keys/release.asc | sudo apt-key add -
   - sudo apt-add-repository
     "deb https://download.ceph.com/debian-${CV} $(lsb_release -sc) main"
diff --git a/Makefile b/Makefile
index 6e8180981..6a14e17b0 100644
--- a/Makefile
+++ b/Makefile
@@ -40,6 +40,14 @@ LDFLAGS += -X $(GO_PROJECT)/internal/util.DriverVersion=$(CSI_IMAGE_VERSION)
 
 BASE_IMAGE ?= $(shell . $(CURDIR)/build.env ; echo $${BASE_IMAGE})
 
+ifndef CEPH_VERSION
+	CEPH_VERSION = $(shell . $(CURDIR)/build.env ; echo $${CEPH_VERSION})
+endif
+ifdef CEPH_VERSION
+	# pass -tags to go commands (for go-ceph build constraints)
+	GO_TAGS = -tags=$(CEPH_VERSION)
+endif
+
 # passing TARGET=static-check on the 'make containerized-test' or 'make
 # containerized-build' commandline will run the selected target instead of
 # 'make test' in the container. Obviously other targets can be passed as well,
@@ -72,7 +80,7 @@ static-check: check-env go-lint lint-extras gosec
 go-test: TEST_COVERAGE ?= $(shell . $(CURDIR)/build.env ; echo $${TEST_COVERAGE})
 go-test: GO_COVER_DIR ?= $(shell . $(CURDIR)/build.env ; echo $${GO_COVER_DIR})
 go-test: check-env
-	TEST_COVERAGE=$(TEST_COVERAGE) GO_COVER_DIR=$(GO_COVER_DIR) ./scripts/test-go.sh
+	TEST_COVERAGE="$(TEST_COVERAGE)" GO_COVER_DIR="$(GO_COVER_DIR)" GO_TAGS="$(GO_TAGS)" ./scripts/test-go.sh
 
 mod-check: check-env
 	@echo 'running: go mod verify'
@@ -100,10 +108,10 @@ lint-py:
 	./scripts/lint-extras.sh lint-py
 
 gosec:
-	./scripts/gosec.sh
+	GO_TAGS="$(GO_TAGS)" ./scripts/gosec.sh
 
 func-test:
-	go test -mod=vendor github.com/ceph/ceph-csi/e2e $(TESTOPTIONS)
+	go test $(GO_TAGS) -mod=vendor github.com/ceph/ceph-csi/e2e $(TESTOPTIONS)
 
 check-env:
 	@./scripts/check-env.sh
@@ -114,10 +122,10 @@ commitlint:
 .PHONY: cephcsi
 cephcsi: check-env
 	if [ ! -d ./vendor ]; then (go mod tidy && go mod vendor); fi
-	GOOS=linux go build -mod vendor -a -ldflags '$(LDFLAGS)' -o _output/cephcsi ./cmd/
+	GOOS=linux go build $(GO_TAGS) -mod vendor -a -ldflags '$(LDFLAGS)' -o _output/cephcsi ./cmd/
 
 e2e.test: check-env
-	go test -mod=vendor -c ./e2e
+	go test $(GO_TAGS) -mod=vendor -c ./e2e
 
 .PHONY: containerized-build containerized-test
 containerized-build: TARGET = cephcsi
diff --git a/scripts/gosec.sh b/scripts/gosec.sh
index 83bd49974..398baa171 100755
--- a/scripts/gosec.sh
+++ b/scripts/gosec.sh
@@ -6,7 +6,7 @@ if [[ -x "$(command -v gosec)" ]]; then
   # gosec does not support -mod=vendor, so fallback to non-module support and
   # assume all dependencies are available in ./vendor already
   export GO111MODULE=off
-  find cmd internal -type d -print0 | xargs --null gosec
+  find cmd internal -type d -print0 | xargs --null gosec "${GO_TAGS}"
 else
   echo "WARNING: gosec not found, skipping security tests" >&2
 fi
diff --git a/scripts/test-go.sh b/scripts/test-go.sh
index 0cf419fb7..d87e809bd 100755
--- a/scripts/test-go.sh
+++ b/scripts/test-go.sh
@@ -6,7 +6,7 @@ COVERFILE="${GO_COVER_DIR}/profile.cov"
 # no special options, exec to go test w/ all pkgs
 if [[ ${TEST_EXITFIRST} != "yes" && -z ${TEST_COVERAGE} ]]; then
 	# shellcheck disable=SC2086
-	exec go test -mod=vendor -v ${GOPACKAGES}
+	exec go test "${GO_TAGS}" -mod=vendor -v ${GOPACKAGES}
 fi
 
 # our options are set so we need to handle each go package one
@@ -20,7 +20,7 @@ failed=0
 for gopackage in ${GOPACKAGES}; do
 	echo "--- testing: ${gopackage} ---"
 	# shellcheck disable=SC2086
-	go test -mod=vendor -v ${GOTESTOPTS} "${gopackage}" || ((failed += 1))
+	go test "${GO_TAGS}" -mod=vendor -v ${GOTESTOPTS} "${gopackage}" || ((failed += 1))
 	if [[ -f cover.out ]]; then
 		# Append to coverfile
 		grep -v "^mode: count" cover.out >>"${COVERFILE}"
diff --git a/scripts/travis-functest.sh b/scripts/travis-functest.sh
index c189d22e4..33d5fd28b 100755
--- a/scripts/travis-functest.sh
+++ b/scripts/travis-functest.sh
@@ -39,7 +39,7 @@ if [[ "${KUBE_MAJOR}" -ge 1 ]] && [[ "${KUBE_MINOR}" -ge 17 ]]; then
 fi
 
 # functional tests
-go test github.com/ceph/ceph-csi/e2e --deploy-timeout=10 -timeout=30m --cephcsi-namespace=cephcsi-e2e-$RANDOM -v -mod=vendor
+go test "${GO_TAGS}" github.com/ceph/ceph-csi/e2e --deploy-timeout=10 -timeout=30m --cephcsi-namespace=cephcsi-e2e-$RANDOM -v -mod=vendor
 
 if [[ "${KUBE_MAJOR}" -ge 1 ]] && [[ "${KUBE_MINOR}" -ge 17 ]]; then
     # delete snapshot CRD
diff --git a/scripts/travis-helmtest.sh b/scripts/travis-helmtest.sh
index d10b29e0c..e1d730454 100755
--- a/scripts/travis-helmtest.sh
+++ b/scripts/travis-helmtest.sh
@@ -49,7 +49,7 @@ scripts/install-helm.sh up
 # install cephcsi helm charts
 scripts/install-helm.sh install-cephcsi ${NAMESPACE}
 # functional tests
-go test github.com/ceph/ceph-csi/e2e -mod=vendor --deploy-timeout=10 -timeout=30m --cephcsi-namespace=${NAMESPACE} --deploy-cephfs=false --deploy-rbd=false -v
+go test "${GO_TAGS}" github.com/ceph/ceph-csi/e2e -mod=vendor --deploy-timeout=10 -timeout=30m --cephcsi-namespace=${NAMESPACE} --deploy-cephfs=false --deploy-rbd=false -v
 
 #cleanup
 # skip snapshot operation if kube version is less than 1.17.0