diff --git a/dovecot.spec b/dovecot.spec
index 189635e..dbb9649 100644
--- a/dovecot.spec
+++ b/dovecot.spec
@@ -6,7 +6,7 @@ Name: dovecot
 Epoch: 1
 Version: 2.3.21
 %global prever %{nil}
-Release: 8%{?dist}
+Release: 9%{?dist}
 #dovecot itself is MIT, a few sources are PD, pigeonhole is LGPLv2
 License: MIT AND LGPL-2.1-only
 
@@ -306,11 +306,16 @@ getent group dovenull >/dev/null || groupadd -r dovenull
 getent passwd dovenull >/dev/null || \
 useradd -r -g dovenull -d /usr/libexec/dovecot -s /sbin/nologin -c "Dovecot's unauthorized user" dovenull
 
-# do not let dovecot run during upgrade rhbz#134325
-if [ "$1" = "2" ]; then
-  rm -f %restart_flag
-  /bin/systemctl is-active %{name}.service >/dev/null 2>&1 && touch %restart_flag ||:
-  /bin/systemctl stop %{name}.service >/dev/null 2>&1
+if [ -z "$LEAPP_IPU_IN_PROGRESS" ]
+then
+  # during LEAPP upgrade, services are not running anyway
+
+  # do not let dovecot run during upgrade rhbz#134325
+  if [ "$1" = "2" ]; then
+    rm -f %restart_flag
+    /bin/systemctl is-active %{name}.service >/dev/null 2>&1 && touch %restart_flag ||:
+    /bin/systemctl stop %{name}.service >/dev/null 2>&1
+  fi
 fi
 
 %post
@@ -333,19 +338,29 @@ if [ $1 = 0 ]; then
 fi
 
 %postun
-/bin/systemctl daemon-reload >/dev/null 2>&1 || :
+if [ -z "$LEAPP_IPU_IN_PROGRESS" ]
+then
+  # during LEAPP upgrade, services are not running anyway
+  /bin/systemctl daemon-reload >/dev/null 2>&1 || :
 
-if [ "$1" -ge "1" -a -e %restart_flag ]; then
-    /bin/systemctl start dovecot.service >/dev/null 2>&1 || :
-rm -f %restart_flag
+  if [ "$1" -ge "1" -a -e %restart_flag ]; then
+      /bin/systemctl start dovecot.service >/dev/null 2>&1 || :
+  rm -f %restart_flag
+  fi
 fi
 
 %posttrans
-# dovecot should be started again in %%postun, but it's not executed on reinstall
-# if it was already started, restart_flag won't be here, so it's ok to test it again
-if [ -e %restart_flag ]; then
+
+if [ -z "$LEAPP_IPU_IN_PROGRESS" ]
+then
+  # during LEAPP upgrade, services are not running anyway
+
+  # dovecot should be started again in %%postun, but it's not executed on reinstall
+  # if it was already started, restart_flag won't be here, so it's ok to test it again
+  if [ -e %restart_flag ]; then
     /bin/systemctl start dovecot.service >/dev/null 2>&1 || :
-rm -f %restart_flag
+    rm -f %restart_flag
+  fi
 fi
 
 %check
@@ -504,6 +519,9 @@ make check
 %{_libdir}/%{name}/dict/libdriver_pgsql.so
 
 %changelog
+* Thu Jun 13 2024 Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.21-9
+- do not run during systemd commands during leap upgrade
+
 * Tue Jun 11 2024 Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.21-8
 - drop dependency on libstemmer (#RHEL-40657)