MariaDB Upgrade from 10.3 to 10.4 with Galera Cluster – mysql.global_priv Table Issue

I have 3-node MariaDB 10.3 Galera Cluster (Ubuntu 14.04) and I want to upgrade it to MariaDB 10.4 Galera Cluster (Ubuntu 18.04).

According to https://mariadb.com/kb/en/library/upgrading-from-mariadb-103-to-mariadb-104-with-galera-cluster/ rolling upgrade is possible (obviously, I need as little downtime as possible).

I did rolling upgrade on dev cluster – I added new server (MariaDB 10.4) to cluster and removed one old server (MariaDB 10.3). Repeated until whole cluster was running MariaDB 10.4. Everything works and looks just fine.

The thing is, in MariaDB 10.4 new authentication mysql table was introduced. According to https://mariadb.com/kb/en/library/authentication-from-mariadb-104/ users should now be stored in mysql.global_priv. Because I did rolling upgrade, myql database was replicated from old nodes to new nodes, so now I dont have mysql.global_priv table in cluster. Users are still in mysql.users table.

Another issue is, when I did new standalone installation of MariaDB 10.4, there was OS admin user mysql@localhost with these privileges

GRANT ALL PRIVILEGES ON *.* TO 'mysql'@'localhost' IDENTIFIED VIA mysql_native_password USING 'invalid' OR unix_socket WITH GRANT OPTION

This user is not present in upgraded cluster (obviously same issue, mysql table was replicated from old nodes), but I cannot create this admin user to get rid of debian-sys-maint@localhost

MariaDB [mysql]> GRANT ALL PRIVILEGES ON *.* TO 'mysql'@'localhost' IDENTIFIED VIA mysql_native_password USING 'invalid' OR unix_socket WITH GRANT OPTION;
ERROR 1372 (HY000): Password hash should be a 41-digit hexadecimal number

So my question is, how can I make clean rolling upgrade of MariaDB Galera Cluster from MariaDB 10.3. to MariaDB 10.4 with all new features introduces in MariaDB 10.4? Any help would be appreciated.