diff --git a/src/yunohost/data_migrations/0021_migrate_to_bullseye.py b/src/yunohost/data_migrations/0021_migrate_to_bullseye.py
index fad29332c..88825dfa1 100644
--- a/src/yunohost/data_migrations/0021_migrate_to_bullseye.py
+++ b/src/yunohost/data_migrations/0021_migrate_to_bullseye.py
@@ -91,7 +91,6 @@ class MyMigration(Migration):
             '#!/bin/bash\n[[ "$1" =~ "nginx" ]] && [[ "$2" == "restart" ]] && exit 101 || exit 0'
         )
         os.system("chmod +x /usr/sbin/policy-rc.d")
-        # FIXME: we still need to explicitly restart nginx somewhere ...
 
         # Don't send an email to root about the postgresql migration. It should be handled automatically after.
         os.system(
@@ -234,8 +233,6 @@ class MyMigration(Migration):
                 "Failed to force the install of php dependencies ?", raw_msg=True
             )
 
-        os.system(f"apt-mark auto {' '.join(basephp74packages_to_install)}")
-
         # Clean the mess
         logger.info(m18n.n("migration_0021_cleaning_up"))
         os.system("apt autoremove --assume-yes")
@@ -263,6 +260,12 @@ class MyMigration(Migration):
                 raw_msg=True,
             )
 
+
+        postupgradecmds = f"apt-mark auto {' '.join(basephp74packages_to_install)}\n"
+        postupgradecmds += "rm -f /usr/sbin/policy-rc.d\n"
+        postupgradecmds += "echo 'Restarting nginx...' >&2\n"
+        postupgradecmds += "systemctl restart nginx\n"
+
         tools_upgrade(target="system")
 
     def debian_major_version(self):
diff --git a/src/yunohost/tools.py b/src/yunohost/tools.py
index c3202cf54..1eaad28bf 100644
--- a/src/yunohost/tools.py
+++ b/src/yunohost/tools.py
@@ -448,7 +448,7 @@ def _list_upgradable_apps():
 
 @is_unit_operation()
 def tools_upgrade(
-    operation_logger, target=None, apps=False, system=False, allow_yunohost_upgrade=True
+    operation_logger, target=None, apps=False, system=False, allow_yunohost_upgrade=True, postupgradecmds=""
 ):
     """
     Update apps & package cache, then display changelog
@@ -646,19 +646,20 @@ def tools_upgrade(
             upgrade_completed = "\n" + m18n.n(
                 "tools_upgrade_special_packages_completed"
             )
-            command = "({wait} && {dist_upgrade}) && {mark_success} || {mark_failure}; {update_metadata}; echo '{done}'".format(
-                wait=wait_until_end_of_yunohost_command,
-                dist_upgrade=dist_upgrade,
-                mark_success=mark_success,
-                mark_failure=mark_failure,
-                update_metadata=update_log_metadata,
-                done=upgrade_completed,
-            )
+            script = f"""
+({wait_until_end_of_yunohost_command} && {dist_upgrade}) \\
+&& {mark_success} \\
+|| {mark_failure}
+
+{update_log_metadata}
+{postupgradecmds}
+echo '{upgrade_completed}'
+"""
 
             logger.warning(m18n.n("tools_upgrade_special_packages_explanation"))
-            logger.debug("Running command :\n{}".format(command))
+            logger.debug("Running script :\n{}".format(script))
             open("/tmp/yunohost-selfupgrade", "w").write(
-                "rm /tmp/yunohost-selfupgrade; " + command
+                "rm /tmp/yunohost-selfupgrade\n " + script
             )
             # Using systemd-run --scope is like nohup/disown and &, but more robust somehow
             # (despite using nohup/disown and &, the self-upgrade process was still getting killed...)