diff --git a/.gitlab/ci/pipelines/debian_repository_full.yml b/.gitlab/ci/pipelines/debian_repository_full.yml
index 450ced3e09cc8318cda6cf8eeb0693bb5850ec04..3c7bb97546becfa1040a3ae9cab1b3ae4c6769c3 100644
--- a/.gitlab/ci/pipelines/debian_repository_full.yml
+++ b/.gitlab/ci/pipelines/debian_repository_full.yml
@@ -31,7 +31,7 @@ datadog_pipeline_trace:
   - DATADOG_SITE=datadoghq.eu datadog-ci tag --level pipeline --tags pipeline_type:$PIPELINE_TYPE
     --tags mr_number:$CI_MERGE_REQUEST_IID
 
-oc.docker-systemd_tests-debian:
+oc.docker-systemd_tests_debian:
   image: ${GCP_REGISTRY}/tezos/docker-images/ci-docker:v1.12.0
   stage: images
   tags:
@@ -64,6 +64,39 @@ oc.docker-systemd_tests-debian:
       - gcp
       - gcp_arm64
 
+oc.docker-systemd_tests_ubuntu:
+  image: ${GCP_REGISTRY}/tezos/docker-images/ci-docker:v1.12.0
+  stage: images
+  tags:
+  - $TAGS
+  dependencies: []
+  timeout: 60 minutes
+  before_script:
+  - ./scripts/ci/docker_initialize.sh
+  script:
+  - ./scripts/ci/build-packages-dependencies.sh images/packages/debian-systemd-tests.Dockerfile
+  services:
+  - docker:${DOCKER_VERSION}-dind
+  variables:
+    DOCKER_VERSION: 24.0.7
+    FLAVOUR: systemd-tests
+    DEP_IMAGE: ${GCP_REGISTRY}/$CI_PROJECT_NAMESPACE/tezos/$FLAVOUR-$DISTRIBUTION-$RELEASE
+    DEP_IMAGE_PROTECTED: ${GCP_PROTECTED_REGISTRY}/tezos/tezos/$FLAVOUR-$DISTRIBUTION-$RELEASE
+    DISTRIBUTION: ubuntu
+  retry:
+    max: 2
+    when:
+    - stuck_or_timeout_failure
+    - runner_system_failure
+  parallel:
+    matrix:
+    - RELEASE:
+      - noble
+      - jammy
+      TAGS:
+      - gcp
+      - gcp_arm64
+
 oc.docker-build-debian-dependencies:
   image: ${GCP_REGISTRY}/tezos/docker-images/ci-docker:v1.12.0
   stage: images
@@ -604,13 +637,13 @@ oc.upgrade_bin_debian_bookworm:
   script:
   - ./docs/introduction/upgrade-bin-deb.sh debian bookworm
 
-oc.install_bin_debian_bookworm-systemd:
+oc.install_bin_debian_bookworm_systemd_test:
   image: ${GCP_REGISTRY}/tezos/docker-images/ci-docker:v1.12.0
   stage: publishing_tests
   tags:
   - gcp
   needs:
-  - oc.docker-systemd_tests-debian
+  - oc.docker-systemd_tests_debian
   - apt_repo_debian
   dependencies: []
   timeout: 60 minutes
@@ -629,6 +662,33 @@ oc.install_bin_debian_bookworm-systemd:
     DISTRIBUTION: debian
     RELEASE: bookworm
 
+oc.upgrade_bin_debian_bookworm-systemd:
+  image: ${GCP_REGISTRY}/tezos/docker-images/ci-docker:v1.12.0
+  stage: publishing_tests
+  tags:
+  - gcp
+  needs:
+  - oc.docker-systemd_tests_debian
+  - apt_repo_debian
+  - apt_repo_debian_old
+  dependencies: []
+  timeout: 60 minutes
+  before_script:
+  - ./scripts/ci/docker_initialize.sh
+  script:
+  - ./scripts/ci/systemd-packages-test.sh scripts/packaging/tests/deb/upgrade-systemd-test.sh
+    images/packages/debian-systemd-tests.Dockerfile
+  services:
+  - docker:${DOCKER_VERSION}-dind
+  variables:
+    DOCKER_VERSION: 24.0.7
+    FLAVOUR: systemd-tests
+    DEP_IMAGE: ${GCP_REGISTRY}/$CI_PROJECT_NAMESPACE/tezos/$FLAVOUR-$DISTRIBUTION-$RELEASE
+    DEP_IMAGE_PROTECTED: ${GCP_PROTECTED_REGISTRY}/tezos/tezos/$FLAVOUR-$DISTRIBUTION-$RELEASE
+    PREFIX: ""
+    DISTRIBUTION: debian
+    RELEASE: bookworm
+
 oc.lintian_ubuntu:
   image: public.ecr.aws/lts/ubuntu:24.04_stable
   stage: publishing_tests
@@ -649,7 +709,7 @@ oc.lintian_ubuntu:
   variables: {}
 
 oc.install_bin_ubunty_jammy:
-  image: debian:bookworm
+  image: public.ecr.aws/lts/ubuntu:22.04_stable
   stage: publishing_tests
   tags:
   - gcp
@@ -668,7 +728,7 @@ oc.install_bin_ubunty_jammy:
     - runner_system_failure
 
 oc.install_bin_ubunty_noble:
-  image: debian:bookworm
+  image: public.ecr.aws/lts/ubuntu:24.04_stable
   stage: publishing_tests
   tags:
   - gcp
@@ -698,3 +758,56 @@ oc.upgrade_bin_ubuntu_jammy:
   timeout: 60 minutes
   script:
   - ./docs/introduction/upgrade-bin-deb.sh ubuntu jammy
+
+oc.install_bin_ubuntu_noble_systemd:
+  image: ${GCP_REGISTRY}/tezos/docker-images/ci-docker:v1.12.0
+  stage: publishing_tests
+  tags:
+  - gcp
+  needs:
+  - oc.docker-systemd_tests_ubuntu
+  - apt_repo_ubuntu
+  dependencies: []
+  timeout: 60 minutes
+  before_script:
+  - ./scripts/ci/docker_initialize.sh
+  script:
+  - ./scripts/ci/systemd-packages-test.sh scripts/packaging/tests/deb/install-bin-deb.sh
+    images/packages/debian-systemd-tests.Dockerfile
+  services:
+  - docker:${DOCKER_VERSION}-dind
+  variables:
+    DOCKER_VERSION: 24.0.7
+    FLAVOUR: systemd-tests
+    DEP_IMAGE: ${GCP_REGISTRY}/$CI_PROJECT_NAMESPACE/tezos/$FLAVOUR-$DISTRIBUTION-$RELEASE
+    DEP_IMAGE_PROTECTED: ${GCP_PROTECTED_REGISTRY}/tezos/tezos/$FLAVOUR-$DISTRIBUTION-$RELEASE
+    PREFIX: ""
+    DISTRIBUTION: ubuntu
+    RELEASE: noble
+
+oc.upgrade_bin_ubuntu_noble_systemd_test:
+  image: ${GCP_REGISTRY}/tezos/docker-images/ci-docker:v1.12.0
+  stage: publishing_tests
+  tags:
+  - gcp
+  needs:
+  - oc.docker-systemd_tests_ubuntu
+  - apt_repo_ubuntu
+  - apt_repo_ubuntu_old
+  dependencies: []
+  timeout: 60 minutes
+  before_script:
+  - ./scripts/ci/docker_initialize.sh
+  script:
+  - ./scripts/ci/systemd-packages-test.sh scripts/packaging/tests/deb/upgrade-systemd-test.sh
+    images/packages/debian-systemd-tests.Dockerfile
+  services:
+  - docker:${DOCKER_VERSION}-dind
+  variables:
+    DOCKER_VERSION: 24.0.7
+    FLAVOUR: systemd-tests
+    DEP_IMAGE: ${GCP_REGISTRY}/$CI_PROJECT_NAMESPACE/tezos/$FLAVOUR-$DISTRIBUTION-$RELEASE
+    DEP_IMAGE_PROTECTED: ${GCP_PROTECTED_REGISTRY}/tezos/tezos/$FLAVOUR-$DISTRIBUTION-$RELEASE
+    PREFIX: ""
+    DISTRIBUTION: ubuntu
+    RELEASE: noble
diff --git a/.gitlab/ci/pipelines/debian_repository_partial.yml b/.gitlab/ci/pipelines/debian_repository_partial.yml
index 26d2d77b078e6a4bbfa7a55e1ff249adc9554214..a454c69d3d02c74c1e8e8ef79cc9774edd3945c7 100644
--- a/.gitlab/ci/pipelines/debian_repository_partial.yml
+++ b/.gitlab/ci/pipelines/debian_repository_partial.yml
@@ -31,7 +31,7 @@ datadog_pipeline_trace:
   - DATADOG_SITE=datadoghq.eu datadog-ci tag --level pipeline --tags pipeline_type:$PIPELINE_TYPE
     --tags mr_number:$CI_MERGE_REQUEST_IID
 
-oc.docker-systemd_tests-debian:
+oc.docker-systemd_tests_debian:
   image: ${GCP_REGISTRY}/tezos/docker-images/ci-docker:v1.12.0
   stage: images
   tags:
@@ -361,13 +361,13 @@ oc.upgrade_bin_debian_bookworm:
   script:
   - ./docs/introduction/upgrade-bin-deb.sh debian bookworm
 
-oc.install_bin_debian_bookworm-systemd:
+oc.install_bin_debian_bookworm_systemd_test:
   image: ${GCP_REGISTRY}/tezos/docker-images/ci-docker:v1.12.0
   stage: publishing_tests
   tags:
   - gcp
   needs:
-  - oc.docker-systemd_tests-debian
+  - oc.docker-systemd_tests_debian
   - apt_repo_debian
   dependencies: []
   timeout: 60 minutes
@@ -385,3 +385,30 @@ oc.install_bin_debian_bookworm-systemd:
     PREFIX: ""
     DISTRIBUTION: debian
     RELEASE: bookworm
+
+oc.upgrade_bin_debian_bookworm-systemd:
+  image: ${GCP_REGISTRY}/tezos/docker-images/ci-docker:v1.12.0
+  stage: publishing_tests
+  tags:
+  - gcp
+  needs:
+  - oc.docker-systemd_tests_debian
+  - apt_repo_debian
+  - apt_repo_debian_old
+  dependencies: []
+  timeout: 60 minutes
+  before_script:
+  - ./scripts/ci/docker_initialize.sh
+  script:
+  - ./scripts/ci/systemd-packages-test.sh scripts/packaging/tests/deb/upgrade-systemd-test.sh
+    images/packages/debian-systemd-tests.Dockerfile
+  services:
+  - docker:${DOCKER_VERSION}-dind
+  variables:
+    DOCKER_VERSION: 24.0.7
+    FLAVOUR: systemd-tests
+    DEP_IMAGE: ${GCP_REGISTRY}/$CI_PROJECT_NAMESPACE/tezos/$FLAVOUR-$DISTRIBUTION-$RELEASE
+    DEP_IMAGE_PROTECTED: ${GCP_PROTECTED_REGISTRY}/tezos/tezos/$FLAVOUR-$DISTRIBUTION-$RELEASE
+    PREFIX: ""
+    DISTRIBUTION: debian
+    RELEASE: bookworm
diff --git a/.gitlab/ci/pipelines/debian_repository_partial_auto.yml b/.gitlab/ci/pipelines/debian_repository_partial_auto.yml
index 0a4ded6597eabd57a7a936d22a5f6747061564c0..defbef7aa927373665c25c03b36d3644e544eee6 100644
--- a/.gitlab/ci/pipelines/debian_repository_partial_auto.yml
+++ b/.gitlab/ci/pipelines/debian_repository_partial_auto.yml
@@ -31,7 +31,7 @@ datadog_pipeline_trace:
   - DATADOG_SITE=datadoghq.eu datadog-ci tag --level pipeline --tags pipeline_type:$PIPELINE_TYPE
     --tags mr_number:$CI_MERGE_REQUEST_IID
 
-oc.docker-systemd_tests-debian:
+oc.docker-systemd_tests_debian:
   image: ${GCP_REGISTRY}/tezos/docker-images/ci-docker:v1.12.0
   stage: images
   tags:
@@ -361,13 +361,13 @@ oc.upgrade_bin_debian_bookworm:
   script:
   - ./docs/introduction/upgrade-bin-deb.sh debian bookworm
 
-oc.install_bin_debian_bookworm-systemd:
+oc.install_bin_debian_bookworm_systemd_test:
   image: ${GCP_REGISTRY}/tezos/docker-images/ci-docker:v1.12.0
   stage: publishing_tests
   tags:
   - gcp
   needs:
-  - oc.docker-systemd_tests-debian
+  - oc.docker-systemd_tests_debian
   - apt_repo_debian
   dependencies: []
   timeout: 60 minutes
@@ -385,3 +385,30 @@ oc.install_bin_debian_bookworm-systemd:
     PREFIX: ""
     DISTRIBUTION: debian
     RELEASE: bookworm
+
+oc.upgrade_bin_debian_bookworm-systemd:
+  image: ${GCP_REGISTRY}/tezos/docker-images/ci-docker:v1.12.0
+  stage: publishing_tests
+  tags:
+  - gcp
+  needs:
+  - oc.docker-systemd_tests_debian
+  - apt_repo_debian
+  - apt_repo_debian_old
+  dependencies: []
+  timeout: 60 minutes
+  before_script:
+  - ./scripts/ci/docker_initialize.sh
+  script:
+  - ./scripts/ci/systemd-packages-test.sh scripts/packaging/tests/deb/upgrade-systemd-test.sh
+    images/packages/debian-systemd-tests.Dockerfile
+  services:
+  - docker:${DOCKER_VERSION}-dind
+  variables:
+    DOCKER_VERSION: 24.0.7
+    FLAVOUR: systemd-tests
+    DEP_IMAGE: ${GCP_REGISTRY}/$CI_PROJECT_NAMESPACE/tezos/$FLAVOUR-$DISTRIBUTION-$RELEASE
+    DEP_IMAGE_PROTECTED: ${GCP_PROTECTED_REGISTRY}/tezos/tezos/$FLAVOUR-$DISTRIBUTION-$RELEASE
+    PREFIX: ""
+    DISTRIBUTION: debian
+    RELEASE: bookworm
diff --git a/ci/bin/debian_repository.ml b/ci/bin/debian_repository.ml
index d85b7fbcf23bae76619d64d63113372e0f62ccf0..15d54c9dbf15b94cdfc378beccddca06e167cca7 100644
--- a/ci/bin/debian_repository.ml
+++ b/ci/bin/debian_repository.ml
@@ -116,10 +116,17 @@ let jobs pipeline_type =
   let job_docker_systemd_test_debian_dependencies : tezos_job =
     make_job_docker_systemd_tests
       ~__POS__
-      ~name:"oc.docker-systemd_tests-debian"
+      ~name:"oc.docker-systemd_tests_debian"
       ~distribution:"debian"
       ~matrix:(debian_package_release_matrix pipeline_type)
   in
+  let job_docker_systemd_test_ubuntu_dependencies : tezos_job =
+    make_job_docker_systemd_tests
+      ~__POS__
+      ~name:"oc.docker-systemd_tests_ubuntu"
+      ~distribution:"ubuntu"
+      ~matrix:(ubuntu_package_release_matrix pipeline_type)
+  in
 
   let make_job_docker_build_debian_dependencies ~__POS__ ~name ~matrix
       ~distribution =
@@ -416,14 +423,14 @@ let jobs pipeline_type =
         ~name:"oc.install_bin_ubunty_jammy"
         ~dependencies:(Dependent [Job job_apt_repo_ubuntu])
         ~variables:[("PREFIX", "")]
-        ~image:Images.debian_bookworm
+        ~image:Images.ubuntu_jammy
         ["./docs/introduction/install-bin-deb.sh ubuntu jammy"];
       job_install_bin
         ~__POS__
         ~name:"oc.install_bin_ubunty_noble"
         ~dependencies:(Dependent [Job job_apt_repo_ubuntu])
         ~variables:[("PREFIX", "")]
-        ~image:Images.debian_bookworm
+        ~image:Images.ubuntu_noble
         ["./docs/introduction/install-bin-deb.sh ubuntu noble"];
       job_upgrade_bin
         ~__POS__
@@ -432,6 +439,43 @@ let jobs pipeline_type =
           (Dependent [Job job_apt_repo_ubuntu_old; Job job_apt_repo_ubuntu])
         ~image:Images.ubuntu_jammy
         ["./docs/introduction/upgrade-bin-deb.sh ubuntu jammy"];
+      job_install_systemd_bin
+        ~__POS__
+        ~name:"oc.install_bin_ubuntu_noble_systemd"
+        ~dependencies:
+          (Dependent
+             [
+               Job job_docker_systemd_test_ubuntu_dependencies;
+               Job job_apt_repo_ubuntu;
+             ])
+        ~variables:
+          (variables
+             ~kind:"systemd-tests"
+             [("PREFIX", ""); ("DISTRIBUTION", "ubuntu"); ("RELEASE", "noble")])
+        [
+          "./scripts/ci/systemd-packages-test.sh \
+           scripts/packaging/tests/deb/install-bin-deb.sh \
+           images/packages/debian-systemd-tests.Dockerfile";
+        ];
+      job_install_systemd_bin
+        ~__POS__
+        ~name:"oc.upgrade_bin_ubuntu_noble_systemd_test"
+        ~dependencies:
+          (Dependent
+             [
+               Job job_docker_systemd_test_ubuntu_dependencies;
+               Job job_apt_repo_ubuntu;
+               Job job_apt_repo_ubuntu_old;
+             ])
+        ~variables:
+          (variables
+             ~kind:"systemd-tests"
+             [("PREFIX", ""); ("DISTRIBUTION", "ubuntu"); ("RELEASE", "noble")])
+        [
+          "./scripts/ci/systemd-packages-test.sh \
+           scripts/packaging/tests/deb/upgrade-systemd-test.sh \
+           images/packages/debian-systemd-tests.Dockerfile";
+        ];
     ]
   in
   let test_debian_packages_jobs =
@@ -458,7 +502,7 @@ let jobs pipeline_type =
         ["./docs/introduction/upgrade-bin-deb.sh debian bookworm"];
       job_install_systemd_bin
         ~__POS__
-        ~name:"oc.install_bin_debian_bookworm-systemd"
+        ~name:"oc.install_bin_debian_bookworm_systemd_test"
         ~dependencies:
           (Dependent
              [
@@ -478,6 +522,29 @@ let jobs pipeline_type =
            docs/introduction/install-bin-deb.sh \
            images/packages/debian-systemd-tests.Dockerfile";
         ];
+      job_install_systemd_bin
+        ~__POS__
+        ~name:"oc.upgrade_bin_debian_bookworm-systemd"
+        ~dependencies:
+          (Dependent
+             [
+               Job job_docker_systemd_test_debian_dependencies;
+               Job job_apt_repo_debian;
+               Job job_apt_repo_debian_old;
+             ])
+        ~variables:
+          (variables
+             ~kind:"systemd-tests"
+             [
+               ("PREFIX", "");
+               ("DISTRIBUTION", "debian");
+               ("RELEASE", "bookworm");
+             ])
+        [
+          "./scripts/ci/systemd-packages-test.sh \
+           scripts/packaging/tests/deb/upgrade-systemd-test.sh \
+           images/packages/debian-systemd-tests.Dockerfile";
+        ];
     ]
   in
   let debian_jobs =
@@ -510,7 +577,8 @@ let jobs pipeline_type =
         job_build_ubuntu_package_old_b,
         job_build_debian_package_old_b )
   | Full ->
-      ( (job_docker_systemd_test_debian_dependencies :: debian_jobs)
+      ( job_docker_systemd_test_debian_dependencies
+        :: job_docker_systemd_test_ubuntu_dependencies :: debian_jobs
         @ ubuntu_jobs @ test_debian_packages_jobs @ test_ubuntu_packages_jobs,
         job_build_ubuntu_package_old_a,
         job_build_debian_package_old_a,
diff --git a/docs/introduction/upgrade-bin-deb.sh b/docs/introduction/upgrade-bin-deb.sh
index 1b97834836dfc5fcf50399a4f3c437a8147f0368..a63a11974297a83d1ed6cd15f3f0c17c680d232e 100755
--- a/docs/introduction/upgrade-bin-deb.sh
+++ b/docs/introduction/upgrade-bin-deb.sh
@@ -61,7 +61,7 @@ set -x
 
 # [install prerequisites]
 apt-get update
-apt-get install -y sudo gpg curl apt-utils debconf-utils
+apt-get install -y sudo gpg curl apt-utils debconf-utils jq
 
 # [preseed debconf]
 echo "debconf debconf/frontend select Noninteractive" | sudo debconf-set-selections
diff --git a/scripts/packaging/octez/debian/control b/scripts/packaging/octez/debian/control
index 431b15dec772f13a99e1b400aee527fef4a63e6b..1150e27bf1f227075ff554d71c95e014791a8270 100644
--- a/scripts/packaging/octez/debian/control
+++ b/scripts/packaging/octez/debian/control
@@ -24,6 +24,7 @@ Depends: adduser,
   debconf (>= 0.5) | debconf-2.0,
   curl,
   systemd
+Pre-Depends: jq
 Recommends: octez-client (= ${source:Version}),
 Suggests: lz4
 Description: L1 Octez node for the Tezos network
diff --git a/scripts/packaging/octez/debian/octez-baker.config b/scripts/packaging/octez/debian/octez-baker.config
index 75a1678339240d201c8af1ddfda7d53613d473e7..ccabb7b54c4b201d0d17df8aaf534935176baf36 100755
--- a/scripts/packaging/octez/debian/octez-baker.config
+++ b/scripts/packaging/octez/debian/octez-baker.config
@@ -2,10 +2,72 @@
 
 set -e
 
+echoerr() { echo "$@" 1>&2; }
+
+new=${2:-}
+
 # shellcheck disable=SC1091
 . /usr/share/debconf/confmodule
 db_version 2.0
 
+case "$new" in
+1:*)
+  echoerr "Upgrade from $new"
+  if [ -e /etc/default/octez-baker-active ]; then
+    #shellcheck disable=SC1091
+    . /etc/default/octez-baker-active
+    db_set octez-baker/liquidity-vote "$LQVOTE"
+    db_set octez-baker/baker-key "$BAKER_KEY"
+    db_set octez-baker/baker-active-protocol "$PROTOCOL"
+  fi
+
+  if [ -e /etc/default/octez-baker-next ]; then
+    #shellcheck disable=SC1091
+    . /etc/default/octez-baker-next
+    db_set octez-baker/baker-next-protocol "$PROTOCOL"
+  fi
+  ;;
+*)
+  echoerr "Legacy upgrade from $new"
+  if [ -e /etc/octez/baker.conf ]; then
+    echoerr "Updating baker configuration from old /etc/octez/baker.conf"
+    # the values set here in debconf are going to be used in the
+    # postinst script to write the /etc/default/ files for this
+    # package
+    #shellcheck disable=SC1091
+    . /etc/octez/baker.conf
+
+    if [ -n "${lq_vote:-}" ]; then
+      echoerr "set lq_vote=$lq_vote"
+      #shellcheck disable=SC2154
+      db_set octez-baker/liquidity-vote "$lq_vote"
+    fi
+
+    if [ -n "${baking_key:-}" ]; then
+      echoerr "set baking_key=$baking_key"
+      #shellcheck disable=SC2154
+      db_set octez-baker/baker-key "$baking_key"
+    fi
+
+    if [ -n "${dalurl:-}" ]; then
+      echoerr "set dalurl=$dalurl"
+      if [ "$dalurl" = "" ]; then
+        #shellcheck disable=SC2154
+        db_set octez-baker/dal-node false
+      else
+        db_set octez-baker/dal-node true
+        db_set octez-baker/dal-node-url "$dalurl"
+      fi
+    else
+      db_set octez-baker/dal-node true
+    fi
+
+    #shellcheck disable=SC2119
+    db_go
+  fi
+  ;;
+esac
+
 db_input high octez-baker/liquidity-vote || true
 # shellcheck disable=SC2119
 db_go || true
diff --git a/scripts/packaging/octez/debian/octez-baker.postinst b/scripts/packaging/octez/debian/octez-baker.postinst
index 5e8ffb71af9c9efd02d3e9adeb2f49f27d203a73..702b0b7942343e58ab00631c7c28ebd467abfc78 100755
--- a/scripts/packaging/octez/debian/octez-baker.postinst
+++ b/scripts/packaging/octez/debian/octez-baker.postinst
@@ -5,6 +5,8 @@ set -e
 # shellcheck disable=SC1091
 . /usr/share/debconf/confmodule
 
+echoerr() { echo "$@" 1>&2; }
+
 db_version 2.0
 
 # work directory to store temporary files associated to this package
@@ -20,6 +22,8 @@ for file in /usr/bin/octez-baker-*; do
   fi
 done
 
+# we guess the active protocol
+ACTIVE_PROTOCOL=$(echo "$PROTO_CHOICES" | tr ' ' '\n' | grep -v '^alpha$' | sort | head -n 1)
 db_subst octez-baker/baker-active-protocol choices "$PROTO_CHOICES"
 db_subst octez-baker/baker-next-protocol choices "none, $PROTO_CHOICES"
 
@@ -29,7 +33,7 @@ configure)
   # if $DPKG_RUNNING_VERSION" is empty a reconfigure
   # Otherwise we're upgrading
   if [ -z "${2:-}" ] || [ -z "$DPKG_RUNNING_VERSION" ]; then
-    echo "Fresh installation (or reconfigure) of the Octez baker"
+    echoerr "Fresh installation (or reconfigure) of the Octez baker"
 
     db_get octez-baker/liquidity-vote
     echo "LQVOTE=${RET}" > /etc/default/octez-baker-active
@@ -63,8 +67,8 @@ configure)
     true)
       db_get octez-baker/dal-node-url
       DALURL=${RET}
-      echo "RUNTIME_OPTS=--dal-node $DALURL" >> /etc/default/octez-baker-next
-      echo "RUNTIME_OPTS=--dal-node $DALURL" >> /etc/default/octez-baker-active
+      echo "RUNTIME_OPTS=\"--dal-node $DALURL\"" >> /etc/default/octez-baker-next
+      echo "RUNTIME_OPTS=\"--dal-node $DALURL\"" >> /etc/default/octez-baker-active
       ;;
     false)
       echo "RUNTIME_OPTS=--without-dal" >> /etc/default/octez-baker-next
@@ -75,7 +79,7 @@ configure)
     mkdir -p /var/tezos/.tezos-client
     chown tezos:tezos /var/tezos/.tezos-client
   else
-    echo "Upgrading octez-baker from version $2 ( postinst )"
+    echoerr "Upgrading octez-baker from version $2 ( postinst )"
     # the configure script is called with the version of the old
     # package in case of upgrade. We display a message to the user
     # in this case. See octez-node.postinst for a detailed explanation.
@@ -84,15 +88,39 @@ configure)
       : noop
       ;;
     *)
-      echo "Setting new defaults in /etc/default/octez-baker-*"
+      echoerr "Setting defaults in /etc/default/octez-baker-*"
+      echoerr "Migrating values when possible"
+
+      db_set octez-baker/baker-active-protocol "$ACTIVE_PROTOCOL"
+
+      db_input medium octez-baker/baker-active-protocol || true
+      # shellcheck disable=SC2119
+      db_go || true
+
+      db_input medium octez-baker/baker-next-protocol || true
+      # shellcheck disable=SC2119
+      db_go || true
+
+      db_get octez-baker/baker-active-protocol
+      echo "PROTOCOL=${RET}" >> /etc/default/octez-baker-active
+
+      db_get octez-baker/baker-next-protocol
+      if [ -n "${RET:-}" ]; then
+        echo "PROTOCOL=${RET}" >> /etc/default/octez-baker-next
+      else
+        echo "#PROTOCOL=${RET}" >> /etc/default/octez-baker-next
+      fi
+      echoerr "PROTOCOL=${RET}"
 
       db_get octez-baker/liquidity-vote
-      echo "LQVOTE=${RET}" > /etc/default/octez-baker-active
-      echo "LQVOTE=${RET}" > /etc/default/octez-baker-next
+      echo "LQVOTE=${RET}" >> /etc/default/octez-baker-active
+      echo "LQVOTE=${RET}" >> /etc/default/octez-baker-next
+      echoerr "LQVOTE=${RET}"
 
       db_get octez-baker/baker-key
       echo "BAKER_KEY=${RET}" >> /etc/default/octez-baker-active
       echo "BAKER_KEY=${RET}" >> /etc/default/octez-baker-next
+      echoerr "BAKER_KEY=${RET}"
 
       db_get octez-baker/dal-node
       DAL=${RET}
@@ -100,12 +128,14 @@ configure)
       true)
         db_get octez-baker/dal-node-url
         DALURL=${RET}
-        echo "RUNTIME_OPTS=--dal-node $DALURL" >> /etc/default/octez-baker-next
-        echo "RUNTIME_OPTS=--dal-node $DALURL" >> /etc/default/octez-baker-active
+        echo "RUNTIME_OPTS=\"--dal-node $DALURL\"" >> /etc/default/octez-baker-next
+        echo "RUNTIME_OPTS=\"--dal-node $DALURL\"" >> /etc/default/octez-baker-active
+        echoerr "RUNTIME_OPTS=--dal-node $DALURL"
         ;;
       false)
         echo "RUNTIME_OPTS=--without-dal" >> /etc/default/octez-baker-next
         echo "RUNTIME_OPTS=--without-dal" >> /etc/default/octez-baker-active
+        echoerr "RUNTIME_OPTS=--without-dal"
         ;;
       esac
 
@@ -117,7 +147,7 @@ configure)
   fi
   ;;
 *)
-  echo "postinst noop"
+  : nop
   ;;
 esac
 
diff --git a/scripts/packaging/octez/debian/octez-baker.preinst b/scripts/packaging/octez/debian/octez-baker.preinst
index cb6d8917de39ce50b8b186cb5998821686b4ce18..62191265368c51739942ac9b48373db7cf0f50cf 100755
--- a/scripts/packaging/octez/debian/octez-baker.preinst
+++ b/scripts/packaging/octez/debian/octez-baker.preinst
@@ -21,7 +21,19 @@ install | upgrade)
     echo "Upgrading Octez baker from version $2 ( preinst )"
     case "$2" in
     1:*)
-      : noop
+      if [ -e /etc/default/octez-baker-active ]; then
+        #shellcheck disable=SC1091
+        . /etc/default/octez-baker-active
+        db_set octez-baker/liquidity-vote "$LQVOTE"
+        db_set octez-baker/baker-key "$BAKER_KEY"
+        db_set octez-baker/baker-active-protocol "$PROTOCOL"
+      fi
+
+      if [ -e /etc/default/octez-baker-next ]; then
+        #shellcheck disable=SC1091
+        . /etc/default/octez-baker-next
+        db_set octez-baker/baker-next-protocol "$PROTOCOL"
+      fi
       ;;
     *)
       if [ -e /etc/octez/baker.conf ]; then
@@ -32,20 +44,20 @@ install | upgrade)
         #shellcheck disable=SC1091
         . /etc/octez/baker.conf
 
-        echo "set lq_vote=$lq_vote"
         if [ -n "${lq_vote:-}" ]; then
+          echo "set lq_vote=$lq_vote"
           #shellcheck disable=SC2154
           db_set octez-baker/liquidity-vote "$lq_vote"
         fi
 
-        echo "set baking_key=$baking_key"
         if [ -n "${baking_key:-}" ]; then
+          echo "set baking_key=$baking_key"
           #shellcheck disable=SC2154
           db_set octez-baker/baker-key "$baking_key"
         fi
 
-        echo "set dalurl=$dalurl"
         if [ -n "${dalurl:-}" ]; then
+          echo "set dalurl=$dalurl"
           if [ "$dalurl" = "" ]; then
             #shellcheck disable=SC2154
             db_set octez-baker/dal-node false
diff --git a/scripts/packaging/octez/debian/octez-node.config b/scripts/packaging/octez/debian/octez-node.config
index 992e24bd54b2e4eb48f53f8c91b85f0cbb47682d..77a528f79e51f10d9396b3792513bbf5aba7ba7e 100755
--- a/scripts/packaging/octez/debian/octez-node.config
+++ b/scripts/packaging/octez/debian/octez-node.config
@@ -6,6 +6,28 @@ set -e
 . /usr/share/debconf/confmodule
 db_version 2.0
 
+CONF=/var/tezos/.tezos-node/config.json
+
+# in case of upgrade from current
+if [ -e /etc/octez/node.conf ]; then
+  #shellcheck disable=SC1091
+  . /etc/octez/node.conf
+  #shellcheck disable=SC2154
+  CONF="$nodedir/config.json"
+fi
+
+if [ -e /etc/default/octez-node ]; then
+  . /etc/default/octez-node
+  CONF="$DATADIR/config.json"
+fi
+
+if [ -e "$CONF" ]; then
+  network=$(jq -r '.network // "mainnet"' "$CONF")
+  db_set octez-node/network "$network"
+  history_mode=$(jq -r '.history_mode' "$CONF")
+  db_set octez-node/history-mode "$history_mode"
+fi
+
 db_input high octez-node/configure || true
 # shellcheck disable=SC2119
 db_go || true
diff --git a/scripts/packaging/tests/deb/upgrade-systemd-test.sh b/scripts/packaging/tests/deb/upgrade-systemd-test.sh
new file mode 100755
index 0000000000000000000000000000000000000000..9bf19877c4a21fcbb1d48ed90c63158fc93ffb54
--- /dev/null
+++ b/scripts/packaging/tests/deb/upgrade-systemd-test.sh
@@ -0,0 +1,139 @@
+#!/bin/sh
+
+set -eu
+set -x
+
+REPO="https://storage.googleapis.com/$GCP_LINUX_PACKAGES_BUCKET/$CI_COMMIT_REF_NAME"
+REPOOLD="https://storage.googleapis.com/$GCP_LINUX_PACKAGES_BUCKET/old/$CI_COMMIT_REF_NAME"
+DISTRO=$1
+RELEASE=$2
+
+# For the upgrade script in the CI, we do not want debconf to ask questions
+export DEBIAN_FRONTEND=noninteractive
+
+apt-get update
+apt-get install -y sudo gpg curl apt-utils debconf-utils procps jq
+
+# [preseed debconf]
+echo "debconf debconf/frontend select Noninteractive" | sudo debconf-set-selections
+
+# [add current repository]
+sudo curl "$REPOOLD/$DISTRO/octez.asc" | sudo gpg --dearmor -o /etc/apt/trusted.gpg.d/octez.gpg
+
+reposityory="deb $REPOOLD/$DISTRO $RELEASE main"
+echo "$reposityory" | sudo tee /etc/apt/sources.list.d/octez-current.list
+sudo apt-get update
+
+# [install octez]
+sudo apt-get install -y octez-client
+sudo apt-get install -y octez-node
+sudo apt-get install -y octez-baker
+dpkg -l octez-\*
+
+# [setup Octez node]
+sudo su tezos -c "octez-node config init --data-dir=/var/tezos/.tezos-node --network=ghostnet --history-mode=rolling --net-addr=\"[::]:9732\" --rpc-addr=\"127.0.0.1:8732\""
+
+curl https://snapshots.tzinit.org/ghostnet/rolling -o /tmp/rolling
+sudo su tezos -c "octez-node snapshot import --data-dir=/var/tezos/.tezos-node --no-check /tmp/rolling"
+
+sudo /etc/init.d/octez-node start
+
+#shellcheck disable=SC2009
+ps aux | grep octez
+
+# [setup baker]
+PROTOCOL=$(octez-client --protocol PtParisBxoLz list understood protocols | tee | head -1)
+sudo su tezos -c "octez-client -p $PROTOCOL gen keys baker"
+BAKER_KEY=$(sudo su tezos -c "octez-client -p $PROTOCOL show address baker" | head -1 | awk '{print $2}')
+echo "baking_key=$BAKER_KEY" >> /etc/octez/baker.conf
+echo "lq_vote=on" >> /etc/octez/baker.conf
+
+# ideally we should also start the baker, but it will timeout
+# waiting for the node to sync
+#sudo /etc/init.d/octez-baker start
+
+#shellcheck disable=SC2009
+ps aux | grep baker
+
+sudo su tezos -c "octez-node config show"
+
+# [add next repository]
+repository="deb $REPO/$DISTRO $RELEASE main"
+echo "$repository" | sudo tee /etc/apt/sources.list.d/octez-next.list
+sudo apt-get update
+
+# [upgrade octez]
+# --force-overwrite is necessary because legacy package shipped the zcash
+# parameters as part of the octez-node package.
+sudo apt-get upgrade -y -o DPkg::options::="--force-overwrite" octez-baker
+
+sudo systemctl enable octez-node
+sudo systemctl enable octez-baker-active
+
+cat /etc/default/octez-node
+cat /etc/default/octez-baker-active
+
+sudo systemctl restart octez-node.service
+sudo systemctl status octez-node.service
+
+sudo systemctl restart octez-baker-active.service
+sudo systemctl status octez-baker-active.service
+
+ERR=0
+
+# [ check configuration after the upgrade ]
+# we check the debconf parameters
+
+#shellcheck disable=SC1091
+. /etc/default/octez-baker-active
+
+# we check if the configuration of octez did not change
+BAKER_KEY_AFTER=$(sudo su tezos -c "octez-client -p $PROTOCOL show address baker" | head -1 | awk '{print $2}')
+if [ "$BAKER_KEY" != "$BAKER_KEY_AFTER" ]; then
+  echo "Client key differ $BAKER_KEY <> $BAKER_KEY_AFTER"
+  ERR=1
+fi
+
+BAKER_KEY_DEBCONF=$(sudo debconf-get-selections | grep octez-baker/baker-key | awk '{print $4}')
+if [ "$BAKER_KEY_DEBCONF" != "$BAKER_KEY_AFTER" ]; then
+  echo "Debconf baker key differ $BAKER_KEY <> $BAKER_KEY_AFTER"
+  ERR=1
+else
+  echo "Debconf baker key differ migrated successfully $BAKER_KEY"
+fi
+
+LQVOTE_DEBCONF=$(sudo debconf-get-selections | grep octez-baker/liquidity-vote | awk '{print $4}')
+if [ "$LQVOTE_DEBCONF" != "on" ]; then
+  echo "Debconf liquidity vote differ $LQVOTE_DEBCONF <> on"
+  ERR=1
+else
+  echo "Debconf liquidity vote migrated successfully \"$LQVOTE_DEBCONF\""
+fi
+
+if [ "$LQVOTE" != "on" ]; then
+  echo "Liquidity vote differ $LQVOTE <> on"
+  ERR=1
+else
+  echo "Liquidity vote migrated successfully \"$LQVOTE\""
+fi
+
+NETWORK_AFTER=$(sudo su tezos -c "octez-node config show" | jq -r .network)
+if [ "$NETWORK_AFTER" != "ghostnet" ]; then
+  echo "Node network differ $NETWORK_AFTER <> ghostnet"
+  ERR=1
+else
+  echo "Node network migrated successfully $NETWORK_AFTER"
+fi
+
+HISTORY_AFTER=$(sudo su tezos -c "octez-node config show" | jq -r .shell.history_mode)
+if [ "$HISTORY_AFTER" != "rolling" ]; then
+  echo "Node history mode differ $HISTORY_AFTER <> rolling"
+  ERR=1
+else
+  echo "Node history mode migrated successfully $HISTORY_AFTER"
+fi
+
+# [check executables version]
+dpkg -l octez-\*
+
+exit "$ERR"