diff --git a/roles/debian/apt_unattended_upgrades/defaults/main.yml b/roles/debian/apt_unattended_upgrades/defaults/main.yml
index 1a52d0a11..855c7f924 100644
--- a/roles/debian/apt_unattended_upgrades/defaults/main.yml
+++ b/roles/debian/apt_unattended_upgrades/defaults/main.yml
@@ -4,6 +4,7 @@ _apt_unattended_upgrades_default_origins:
     - "origin=Debian,codename=${distro_codename}-security,label=Debian-Security"
 apt_unattended_upgrades:
   enable: true
+  linotp: "false"
   # unattended-upgrades template vars.
   # booleans must be strings to avoid Jinja2 interpretting.
   origins: "{{ _apt_unattended_upgrades_default_origins }}"
diff --git a/roles/debian/apt_unattended_upgrades/tasks/main.yml b/roles/debian/apt_unattended_upgrades/tasks/main.yml
index 935cad765..52b6d681a 100644
--- a/roles/debian/apt_unattended_upgrades/tasks/main.yml
+++ b/roles/debian/apt_unattended_upgrades/tasks/main.yml
@@ -25,6 +25,30 @@
     force: true
   when: apt_unattended_upgrades.enable
 
+- name: Copy unattended-upgrades linotp APT hook script.
+  ansible.builtin.template:
+    src: linotp-apt-hook.sh.j2
+    dest: /usr/local/sbin/linotp-apt-hook.sh
+    owner: root
+    group: root
+    mode: "0755"
+    force: true
+  when:
+    - apt_unattended_upgrades.enable
+    - apt_unattended_upgrades.linotp
+
+- name: Copy unattended-upgrades linotp configuration file.
+  ansible.builtin.template:
+    src: 79linotp-pre-and-post.j2
+    dest: /etc/apt/apt.conf.d/79linotp-pre-and-post
+    owner: root
+    group: root
+    mode: "0644"
+    force: true
+  when:
+    - apt_unattended_upgrades.enable
+    - apt_unattended_upgrades.linotp
+
 - name: Enable and start service unattended-upgrades.
   ansible.builtin.service:
     name: unattended-upgrades
diff --git a/roles/debian/apt_unattended_upgrades/templates/79linotp-pre-and-post.j2 b/roles/debian/apt_unattended_upgrades/templates/79linotp-pre-and-post.j2
new file mode 100644
index 000000000..98f4a5c2a
--- /dev/null
+++ b/roles/debian/apt_unattended_upgrades/templates/79linotp-pre-and-post.j2
@@ -0,0 +1,3 @@
+// r71691 Makes sure linotp database is backed up prior to upgrade then initialised.
+DPkg::Pre-Invoke  { "/usr/local/sbin/linotp-apt-hook.sh"; };
+DPkg::Post-Invoke { "/usr/local/sbin/linotp-apt-hook.sh"; };
diff --git a/roles/debian/apt_unattended_upgrades/templates/linotp-apt-hook.sh.j2 b/roles/debian/apt_unattended_upgrades/templates/linotp-apt-hook.sh.j2
new file mode 100644
index 000000000..45d88660b
--- /dev/null
+++ b/roles/debian/apt_unattended_upgrades/templates/linotp-apt-hook.sh.j2
@@ -0,0 +1,22 @@
+#!/bin/bash
+
+LOG="/var/log/linotp-upgrade.log"
+BACKUP_DIR="/home/deploy/linotp_dbbackups"
+CREDS="/home/deploy/.mysql.creds"
+
+if apt list --upgradable 2>/dev/null | grep -q '^linotp/'; then
+    echo "[linotp-pre] linotp will be upgraded. Backing up database..." | tee -a "$LOG"
+    mkdir -p "$BACKUP_DIR"
+    mysqldump --defaults-file="$CREDS" linotp > "$BACKUP_DIR/linotp_backup_$(date +%F_%H-%M-%S).sql" && \
+        echo "[linotp-pre] Backup complete." | tee -a "$LOG" || \
+        echo "[linotp-pre] WARNING: Backup failed!" | tee -a "$LOG"
+    export LINOTP_UPGRADING=1
+fi
+
+if [ "$LINOTP_UPGRADING" = "1" ]; then
+    echo "[linotp-post] linotp was upgraded. Running database init..." | tee -a "$LOG"
+    linotp init database && \
+        echo "[linotp-post] linotp init database completed." | tee -a "$LOG" || \
+        echo "[linotp-post] linotp init database failed!" | tee -a "$LOG"
+    export LINOTP_UPGRADING=0
+fi