When images for rpm-ostree or bootc are built, upgrade scriptlets cannot be run to modify mutable content on production system. This is due to the fact that building an image is different from deploying it. As a result, upgrade of client side configuration cannot be handled as an RPM scriptlet.

We need to figure out how to run the upgrade post-deployment. One option would be to add a systemd service Type=oneshot with a conditional ConditionDirectoryNotEmpty=/var/lib/ipa-client/sysrestore/.