diff --git a/scripts/upgrade b/scripts/upgrade
index 5fb9820..2652ce0 100644
--- a/scripts/upgrade
+++ b/scripts/upgrade
@@ -43,6 +43,26 @@ elif [ -z "${dns_over_https:-}" ] || [ "${dns_over_https:-}" == "0" ]; then
     ynh_exec_warn_less yunohost firewall reload
 fi
 
+# fill the 'tls:' section of the AGH configuration if necessary
+if grep -q "certificate_path: \"\"" "$install_dir/AdGuardHome.yaml" || grep -q "private_key_path: \"\"" "$install_dir/AdGuardHome.yaml" || grep -q "server_name: \"\"" "$install_dir/AdGuardHome.yaml"; then
+	ynh_replace_string --match_string="enabled: \"\"" --replace_string="enabled: \"$dns_over_https\"" --target_file="$install_dir/AdGuardHome.yaml"
+	# using sed magic because of the line break :/
+	sed --in-place "/tls:$/{n;s/enabled: false/enabled: $dns_over_https/}" "$install_dir/AdGuardHome.yaml"
+	ynh_replace_string --match_string="server_name: \"\"" --replace_string="server_name: \"$domain\"" --target_file="$install_dir/AdGuardHome.yaml"
+	ynh_replace_string --match_string="allow_unencrypted_doh: false" --replace_string="allow_unencrypted_doh: true" --target_file="$install_dir/AdGuardHome.yaml"
+	ynh_replace_string --match_string="certificate_path: \"\"" --replace_string="certificate_path: \"/etc/yunohost/certs/$domain/crt.pem\"" --target_file="$install_dir/AdGuardHome.yaml"
+	ynh_replace_string --match_string="private_key_path: \"\"" --replace_string="private_key_path: \"/etc/yunohost/certs/$domain/key.pem\"" --target_file="$install_dir/AdGuardHome.yaml"
+fi
+
+# check if one of 'port_https:', 'port_dns_over_tls:' or 'port_dns_over_quic:' uses the default setting
+if grep -q "port_https: \"443\"" "$install_dir/AdGuardHome.yaml" || grep -q "port_dns_over_tls: \"853\"" "$install_dir/AdGuardHome.yaml" || grep -q "port_dns_over_quic: \"784\"" "$install_dir/AdGuardHome.yaml"; then
+	# if so: mandatory replacement for them
+	# (because the final user can't easily know the ports used by the package)
+	ynh_replace_string --match_string="port_https: \"443\"" --replace_string="port_https: \"$port_internal_https\"" --target_file="$install_dir/AdGuardHome.yaml"
+	ynh_replace_string --match_string="port_dns_over_tls: \"853\"" --replace_string="port_dns_over_tls: \"$port_dns_over_http\"" --target_file="$install_dir/AdGuardHome.yaml"
+	ynh_replace_string --match_string="port_dns_over_quic: \"784\"" --replace_string="port_dns_over_quic: \"$port_dns_over_quic\"" --target_file="$install_dir/AdGuardHome.yaml"
+fi
+
 if [ -n "${open_port_53:-}" ] && [ "${open_port_53:-}" == "1" ]; then
     open_port_53="true"
 	ynh_app_setting_set --app="$app" --key=open_port_53 --value="$open_port_53"