diff --git a/admin/securedrop_admin/__init__.py b/admin/securedrop_admin/__init__.py
index 156d43b949..910f71a891 100755
--- a/admin/securedrop_admin/__init__.py
+++ b/admin/securedrop_admin/__init__.py
@@ -36,6 +36,7 @@
 import prompt_toolkit
 from prompt_toolkit.validation import Validator, ValidationError
 import yaml
+from pkg_resources import parse_version
 
 sdlog = logging.getLogger(__name__)
 RELEASE_KEY = '22245C81E3BAEB4138B36061310F561200F4AD77'
@@ -628,6 +629,9 @@ def check_for_updates(args):
     # Do not check out any release candidate tags
     all_prod_tags = [x for x in all_tags if 'rc' not in x]
 
+    # We want the tags to be sorted based on semver
+    all_prod_tags.sort(key=parse_version)
+
     latest_tag = all_prod_tags[-1]
 
     if current_tag != latest_tag:
diff --git a/admin/tests/test_securedrop-admin.py b/admin/tests/test_securedrop-admin.py
index f92ba7a39c..7e88279dd7 100644
--- a/admin/tests/test_securedrop-admin.py
+++ b/admin/tests/test_securedrop-admin.py
@@ -66,6 +66,20 @@ def test_check_for_updates_update_needed(self, tmpdir, caplog):
                 assert update_status is True
                 assert tag == '0.6.1'
 
+    def test_check_for_updates_higher_version(self, tmpdir, caplog):
+        git_repo_path = str(tmpdir)
+        args = argparse.Namespace(root=git_repo_path)
+        current_tag = "0.6"
+        tags_available = "0.1\n0.10.0\n0.6.2\n0.6\n0.6-rc1\n0.9.0\n"
+
+        with mock.patch('subprocess.check_call'):
+            with mock.patch('subprocess.check_output',
+                            side_effect=[current_tag, tags_available]):
+                update_status, tag = securedrop_admin.check_for_updates(args)
+                assert "Update needed" in caplog.text
+                assert update_status is True
+                assert tag == '0.10.0'
+
     def test_check_for_updates_ensure_newline_stripped(self, tmpdir, caplog):
         """Regression test for #3426"""
         git_repo_path = str(tmpdir)