diff --git a/implementations/main.cpp b/implementations/main.cpp
index 00c7eac..56df2c8 100644
--- a/implementations/main.cpp
+++ b/implementations/main.cpp
@@ -68,7 +68,7 @@ namespace {
 
 // Bumping this is what publishes a package: the registry answers 409 for a
 // version it already has, which a build treats as a no-op.
-constexpr const char* Version = "0.2.2";
+constexpr const char* Version = "0.2.3";
 
 bool g_verbose = false;
 // 500 ms was the research harness's pace, chosen so a human could read the
diff --git a/packaging/APKBUILD b/packaging/APKBUILD
index fec4800..458a0aa 100644
--- a/packaging/APKBUILD
+++ b/packaging/APKBUILD
@@ -10,7 +10,7 @@
 # Alpine, so an APKBUILD that compiled from source could not be built by
 # anyone but us either.
 pkgname=fingerprintd
-pkgver=0.2.2
+pkgver=0.2.3
 pkgrel=0
 pkgdesc="Fingerprint daemon for the Fairphone 6 (FocalTech FT9391 behind QTEE)"
 url="https://forgejo.catcrafts.net/Catcrafts/fingerprintd"
@@ -30,7 +30,10 @@ license="GPL-3.0-only"
 # trustlet out of the stock modem partition on first boot. Without it there is
 # no matcher and the unit stays inert on its ConditionPathExists -- so this is
 # a real dependency, not a nicety. It is an FP6 device package; so is this.
-depends="dbus glib libc++ fprintd-pam fp6-vendor-blobs"
+# The mbn directive the fragment uses arrived in 1-r2; the extractor before it
+# exits on an unknown directive, which on a first boot would fail the blobs
+# unit after the audio fragment had run and before this one could.
+depends="dbus glib libc++ fprintd-pam fp6-vendor-blobs>=1-r2"
 # The versioned provides both satisfies plasma-workspace's fprintd dependency
 # — its Users KCM is the fingerprint enrolment UI and speaks exactly this bus
 # name — and EXCLUDES the real package, which is required rather than tidy:
@@ -52,6 +55,9 @@ subpackages="$pkgname-agent $pkgname-systemd"
 # traced against an x86_64 build host
 options="!check !tracedeps"
 source="fingerprintd-$pkgver.tar.gz"
+# apk swaps the binary on disk and leaves the running daemon alone; the
+# script restarts it so an upgrade does not leave the old code answering.
+install="$pkgname.post-upgrade"
 
 package() {
 	cd "$srcdir/fingerprintd-$pkgver"
diff --git a/packaging/build-package.sh b/packaging/build-package.sh
index 52a7c35..14b45f0 100755
--- a/packaging/build-package.sh
+++ b/packaging/build-package.sh
@@ -94,6 +94,8 @@ PKG="$HOME/pkg"
 rm -rf "$PKG"
 mkdir -p "$PKG"
 cp "$SRC/packaging/APKBUILD" "$PKG/APKBUILD"
+# install= scripts are read from the aport dir, not from source=
+cp "$SRC/packaging/fingerprintd.post-upgrade" "$PKG/"
 mv "fingerprintd-$VER.tar.gz" "$PKG/"
 sed -i "s/^pkgver=.*/pkgver=$VER/" "$PKG/APKBUILD"
 # a throwaway signing key: phones trust the registry-signed APKINDEX, not
diff --git a/packaging/fingerprintd.post-upgrade b/packaging/fingerprintd.post-upgrade
new file mode 100644
index 0000000..8dd66b5
--- /dev/null
+++ b/packaging/fingerprintd.post-upgrade
@@ -0,0 +1,15 @@
+#!/bin/sh
+# SPDX-License-Identifier: GPL-3.0-only
+# SPDX-FileCopyrightText: Copyright (C) 2026 Catcrafts®
+#
+# apk replaces /usr/bin/fingerprintd on disk and leaves the running daemon
+# alone. The phone is then a working matcher running the OLD code: the journal
+# says MATCH and whatever the upgrade added is dead until a reboot, which is
+# how 0.2.2's FingerMatched signal first presented (fp6 journal, fingerprint
+# lane, 2026-09-05). Restart it if it is running.
+#
+# try-restart: a daemon that is not running -- no /dev/tee0, no trustlet --
+# stays not running. Inside a build or CI chroot there is no systemd to ask.
+[ -d /run/systemd/system ] || exit 0
+systemctl try-restart fingerprintd.service 2>/dev/null || :
+exit 0