diff --git a/conf/.env b/conf/.env
index 6b62b335..1d14f831 100644
--- a/conf/.env
+++ b/conf/.env
@@ -1,6 +1,6 @@
 APP_NAME=__APP__
 APP_ENV=production
-APP_KEY=
+APP_KEY=__APP_KEY__
 APP_DEBUG=false
 APP_URL=https://__DOMAIN__
 
diff --git a/manifest.json b/manifest.json
index ef4cd63b..b01bab6b 100644
--- a/manifest.json
+++ b/manifest.json
@@ -5,7 +5,7 @@
     "description": {
         "en": "ActivityPub Federated Image Sharing"
     },
-    "version": "0.8.6~ynh2",
+    "version": "0.8.6~ynh3",
     "url": "https://pixelfed.org/",
     "license": "AGPL-3.0-or-later",
     "maintainer": {
diff --git a/scripts/install b/scripts/install
index 10818d58..d60e5fa4 100644
--- a/scripts/install
+++ b/scripts/install
@@ -23,6 +23,8 @@ ynh_abort_if_errors
 domain=$YNH_APP_ARG_DOMAIN
 path_url="/"
 is_public=$YNH_APP_ARG_IS_PUBLIC
+app_key=$(ynh_string_random 32 | base64)
+app_key="base64:$app_key"
 
 app=$YNH_APP_INSTANCE_NAME
 
@@ -44,6 +46,7 @@ ynh_webpath_register "$app" "$domain" "$path_url"
 ynh_app_setting_set "$app" domain "$domain"
 ynh_app_setting_set "$app" path "$path_url"
 ynh_app_setting_set "$app" is_public "$is_public"
+ynh_app_setting_set "$app" app_key "$app_key"
 
 #=================================================
 # STANDARD MODIFICATIONS
@@ -129,6 +132,7 @@ config="$final_path/.env"
 cp ../conf/.env "$config"
 
 ynh_replace_string "__APP__"     "$app"      "$config"
+ynh_replace_string "__APP_KEY__"     "$app_key"      "$config"
 ynh_replace_string "__DOMAIN__"  "$domain"   "$config"
 ynh_replace_string "__PATH__"    "$path_url" "$config"
 ynh_replace_string "__DB_NAME__" "$db_name"  "$config"
diff --git a/scripts/upgrade b/scripts/upgrade
index 775e04db..87b3e2f8 100644
--- a/scripts/upgrade
+++ b/scripts/upgrade
@@ -23,6 +23,9 @@ is_public=$(ynh_app_setting_get "$app" is_public)
 final_path=$(ynh_app_setting_get "$app" final_path)
 language=$(ynh_app_setting_get "$app" language)
 db_name=$(ynh_app_setting_get "$app" db_name)
+db_user=$db_name
+db_pwd=$(ynh_app_setting_get "$app" db_pwd)
+app_key=$(ynh_app_setting_get "$app" app_key)
 
 #=================================================
 # ENSURE DOWNWARD COMPATIBILITY
@@ -50,6 +53,12 @@ if [ -z "$final_path" ]; then
 	ynh_app_setting_set "$app" final_path "$final_path"
 fi
 
+# If app_key doesn't exist, retrieve it
+if [ -z "$app_key" ]; then
+	app_key=$(grep -oP "APP_KEY=\Kbase64.*" "$final_path/.env")
+	ynh_app_setting_set "$app" app_key "$app_key"
+fi
+
 #=================================================
 # BACKUP BEFORE UPGRADE THEN ACTIVE TRAP
 #=================================================
@@ -134,6 +143,21 @@ chown -R "$app": "$final_path"
 
 ynh_install_composer --workdir="$final_path"
 
+#=================================================
+# MODIFY A CONFIG FILE
+#=================================================
+
+config="$final_path/.env"
+cp ../conf/.env "$config"
+
+ynh_replace_string "__APP__"     "$app"      "$config"
+ynh_replace_string "__APP_KEY__"     "$app_key"      "$config"
+ynh_replace_string "__DOMAIN__"  "$domain"   "$config"
+ynh_replace_string "__PATH__"    "$path_url" "$config"
+ynh_replace_string "__DB_NAME__" "$db_name"  "$config"
+ynh_replace_string "__DB_USER__" "$db_user"  "$config"
+ynh_replace_string "__DB_PWD__"  "$db_pwd"   "$config"
+
 #=================================================
 # DEPLOYMENT
 #=================================================
@@ -149,11 +173,14 @@ pushd "$final_path"
 	php7.2 artisan horizon:purge
 popd
 
+#=================================================
+# STORE THE CHECKSUM OF THE CONFIG FILE
+#=================================================
 
+ynh_backup_if_checksum_is_different "$config"
 
-ynh_backup_if_checksum_is_different "$final_path/CONFIG_FILE"
 # Recalculate and store the checksum of the file for the next upgrade.
-ynh_store_file_checksum "$final_path/.env"
+ynh_store_file_checksum "$config"
 
 #=================================================
 # GENERIC FINALIZATION