diff --git a/opendnssec.spec b/opendnssec.spec
index d3dd7fc..8ca286a 100644
--- a/opendnssec.spec
+++ b/opendnssec.spec
@@ -4,7 +4,7 @@
 Summary: DNSSEC key and zone management software
 Name: opendnssec
 Version: 1.4.9
-Release: 2%{?prever}%{?dist}
+Release: 3%{?prever}%{?dist}
 License: BSD
 Url: http://www.opendnssec.org/
 Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz
@@ -17,7 +17,7 @@ Source6: opendnssec.cron
 
 Group: Applications/System
 Requires: opencryptoki, softhsm, systemd-units
-Requires: libxml2, libxslt
+Requires: libxml2, libxslt sqlite
 BuildRequires: ldns-devel >= 1.6.12, sqlite-devel , openssl-devel
 BuildRequires: libxml2-devel CUnit-devel, doxygen
 # It tests for pkill/killall and would use /bin/false if not found
@@ -57,7 +57,7 @@ make %{?_smp_mflags}
 %install
 rm -rf %{buildroot}
 make DESTDIR=%{buildroot} install
-mkdir -p %{buildroot}/var/opendnssec/{tmp,signed,signconf}
+mkdir -p %{buildroot}%{_localstatedir}/opendnssec/{tmp,signed,signconf}
 install -d -m 0755 %{buildroot}%{_initrddir} %{buildroot}%{_sysconfdir}/cron.d/
 install -m 0644 %{SOURCE6} %{buildroot}/%{_sysconfdir}/cron.d/opendnssec
 rm -f %{buildroot}/%{_sysconfdir}/opendnssec/*.sample
@@ -70,6 +70,7 @@ install -m 0644 %{SOURCE4} %{buildroot}/%{_sysconfdir}/opendnssec/
 mkdir -p %{buildroot}%{_sysconfdir}/tmpfiles.d/
 install -m 0644 %{SOURCE5} %{buildroot}%{_sysconfdir}/tmpfiles.d/opendnssec.conf
 mkdir -p %{buildroot}%{_localstatedir}/run/opendnssec
+cp enforcer/utils/migrate_1_4_8.sqlite3 %{buildroot}%{_datadir}/%{name}/
 
 %files
 %{_unitdir}/ods-enforcerd.service
@@ -101,15 +102,23 @@ exit 0
 %post
 # Initialise a slot on the softhsm on first install
 if [ "$1" -eq 1 ]; then
-   %{_sbindir}/runuser -u ods -- %{_bindir}/softhsm2-util --init-token --slot 0 --label "OpenDNSSEC" --pin 1234 --so-pin 1234
-
+   %{_sbindir}/runuser -u ods -- %{_bindir}/softhsm2-util --init-token \
+                --slot 0 --label "OpenDNSSEC" --pin 1234 --so-pin 1234
+   if [ ! -s %{_localstatedir}opendnssec/kasp.db ]; then
+      echo y | %{_bindir}/ods-ksmutil setup
+   fi
 fi
+
+# Migrate version 3 db to version 4 db
+if [ "`%{_bindir}/sqlite3 %{_localstatedir}/%{name}/kasp.db 'select version from dbadmin;'`" != "4" ]; then
+   %{_bindir}/sqlite3 %{_localstatedir}/%{name}/kasp.db < %{_datadir}/%{name}/migrate_1_4_8.sqlite3
+fi
+
 # in case we update any xml conf file
 ods-ksmutil update all >/dev/null 2>/dev/null ||:
 %systemd_post ods-enforcerd.service
 %systemd_post ods-signerd.service
 
-
 %preun
 %systemd_preun ods-enforcerd.service
 %systemd_preun ods-signerd.service
@@ -119,6 +128,10 @@ ods-ksmutil update all >/dev/null 2>/dev/null ||:
 %systemd_postun_with_restart ods-signerd.service
 
 %changelog
+* Thu Feb 18 2016 Paul Wouters <pwouters@redhat.com> - 1.4.9-3
+- Resolves: rbz#1303965 upgrade to opendnssec-1.4.9-1.fc23 breaks old installations
+- On initial install, after token init, also run ods-ksmutil setup
+
 * Thu Feb 04 2016 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.9-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild