diff --git a/contrib/Makefile.am b/contrib/Makefile.am
index cfd0b15a..37c4aa4d 100644
--- a/contrib/Makefile.am
+++ b/contrib/Makefile.am
@@ -2,3 +2,13 @@ SUBDIRS = \
 	systemd \
 	dgsm \
 	$(NULL)
+
+EXTRA_DIST = osmo-hlr-post-upgrade.sh
+
+install-data-hook:
+	install -Dm755 $(srcdir)/osmo-hlr-post-upgrade.sh \
+		-t $(DESTDIR)$(datadir)/osmocom/
+
+uninstall-hook:
+	@$(PRE_UNINSTALL)
+	$(RM) $(DESTDIR)$(datadir)/osmocom/osmo-hlr-post-upgrade.sh
diff --git a/contrib/osmo-hlr-post-upgrade.sh b/contrib/osmo-hlr-post-upgrade.sh
new file mode 100644
index 00000000..eaef4177
--- /dev/null
+++ b/contrib/osmo-hlr-post-upgrade.sh
@@ -0,0 +1,95 @@
+#!/bin/sh -e
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# Copyright 2021 sysmocom s.f.m.c GmbH <info@sysmocom.de>
+#
+# Packagers are supposed to call this script in post-upgrade, so it can safely
+# upgrade the database scheme if required.
+
+DB="/var/lib/osmocom/hlr.db"
+IS_ACTIVE=0
+
+msg() {
+	echo "osmo-hlr-post-upgrade: $@"
+}
+
+err() {
+	msg "ERROR: $@"
+}
+
+open_db() {
+	# Attempt to open the database with osmo-hlr-db-tool, it will fail if
+	# upgrading the schema is required
+	osmo-hlr-db-tool -s -l "$DB" create
+}
+
+check_upgrade_required() {
+	if ! [ -e "$DB" ]; then
+		msg "nothing to do (no existing database)"
+		exit 0
+	fi
+
+	if open_db 2>/dev/null; then
+		msg "nothing to do (database version is up to date)"
+		exit 0
+	fi
+
+	msg "database upgrade is required"
+}
+
+stop_service() {
+	if systemctl is-active -q osmo-hlr; then
+		IS_ACTIVE=1
+		msg "stopping osmo-hlr service"
+		systemctl stop osmo-hlr
+
+		# Verify that it stopped
+		for i in $(seq 1 100); do
+			if ! systemctl is-active -q osmo-hlr; then
+				return
+			fi
+			sleep 0.1
+		done
+
+		err "failed to stop osmo-hlr service"
+		exit 1
+	else
+		msg "osmo-hlr service is not running"
+	fi
+}
+
+create_backup() {
+	backup="$DB.$(date +%Y%m%d%H%M%S).bak"
+	msg "creating backup: $backup"
+	if [ -e "$backup" ]; then
+		err "backup already exists: $backup"
+		exit 1
+	fi
+	cp "$DB" "$backup"
+}
+
+upgrade() {
+	msg "performing database upgrade"
+	osmo-hlr-db-tool -s -U -l "$DB" create
+
+	if ! open_db 2>/dev/null; then
+		err "failed to open the database after upgrade"
+		err "osmo-hlr-db-tool output:"
+		open_db
+		# exit because of "set -e"
+	fi
+
+	msg "database upgrade successful"
+}
+
+start_service() {
+	if [ "$IS_ACTIVE" = "1" ]; then
+		msg "starting osmo-hlr service"
+		systemctl start osmo-hlr
+	fi
+}
+
+check_upgrade_required
+stop_service
+create_backup
+upgrade
+start_service
diff --git a/contrib/osmo-hlr.spec.in b/contrib/osmo-hlr.spec.in
index c4029be2..d0a1b57a 100644
--- a/contrib/osmo-hlr.spec.in
+++ b/contrib/osmo-hlr.spec.in
@@ -136,10 +136,13 @@ make %{?_smp_mflags} check || (find . -name testsuite.log -exec cat {} +)
 
 %pre
 %service_add_pre %{name}.service
+%endif
 
 %post
+%if 0%{?suse_version}
 %service_add_post %{name}.service
 %endif
+/usr/share/osmocom/osmo-hlr-post-upgrade.sh
 
 %post   -n libosmo-gsup-client0 -p /sbin/ldconfig
 %postun -n libosmo-gsup-client0 -p /sbin/ldconfig
@@ -162,6 +165,8 @@ make %{?_smp_mflags} check || (find . -name testsuite.log -exec cat {} +)
 %dir %{_sysconfdir}/osmocom
 %config %{_sysconfdir}/osmocom/osmo-hlr.cfg
 %{_unitdir}/osmo-hlr.service
+%dir %{_datadir}/osmocom
+%{_datadir}/osmocom/osmo-hlr-post-upgrade.sh
 
 %files -n libosmo-gsup-client0
 %{_libdir}/libosmo-gsup-client.so.0*
diff --git a/debian/osmo-hlr.install b/debian/osmo-hlr.install
index 1b2cb56c..421d5f43 100644
--- a/debian/osmo-hlr.install
+++ b/debian/osmo-hlr.install
@@ -5,4 +5,5 @@
 /usr/share/doc/osmo-hlr/sql/hlr.sql
 /usr/share/doc/osmo-hlr/sql/hlr_data.sql
 /usr/share/doc/osmo-hlr/examples/osmo-hlr.cfg
+/usr/share/osmocom/osmo-hlr-post-upgrade.sh
 /var/lib/osmocom
diff --git a/debian/postinst b/debian/postinst
new file mode 100755
index 00000000..390d3044
--- /dev/null
+++ b/debian/postinst
@@ -0,0 +1,5 @@
+#!/bin/sh -e
+# Debian's postinst script is called on both installation and upgrade. Call the
+# post-upgrade script in both cases, it won't do anything if there is nothing
+# to do.
+/usr/share/osmocom/osmo-hlr-post-upgrade.sh