diff --git a/instack_undercloud/undercloud.py b/instack_undercloud/undercloud.py
index 747b091f4..7d8787474 100644
--- a/instack_undercloud/undercloud.py
+++ b/instack_undercloud/undercloud.py
@@ -1238,6 +1238,18 @@ def install(instack_root):
     _validate_configuration()
     instack_env = _generate_environment(instack_root)
     _generate_init_data(instack_env)
+    # Even if we backport https://review.openstack.org/#/c/457478/
+    # into stable branches of puppet-ironic, we still need a way
+    # to handle existing deployments.
+    # This task will fix ironic-dbsync.log ownership on existing
+    # deployments during an upgrade. It can be removed after we
+    # release Pike.
+    try:
+        _run_command(['sudo', '/usr/bin/chown', 'ironic:ironic',
+                      '/var/log/ironic/ironic-dbsync.log'])
+    except subprocess.CalledProcessError:
+        # assume it's a fresh installation, and the file does not exist
+        pass
     _die_tuskar_die()
     _run_yum_update(instack_env)
     _run_instack(instack_env)
diff --git a/releasenotes/notes/ironic-dbsync-da5d047e92841f78.yaml b/releasenotes/notes/ironic-dbsync-da5d047e92841f78.yaml
new file mode 100644
index 000000000..5cee8904b
--- /dev/null
+++ b/releasenotes/notes/ironic-dbsync-da5d047e92841f78.yaml
@@ -0,0 +1,9 @@
+---
+upgrade:
+  - |
+    Undercloud upgrade will handle the change of ownership for ironic-dbsync.log
+    to become ironic:ironic instead of root:root.
+    Indeed, https://review.openstack.org/#/c/457478/ broke TripleO upgrades but
+    it's to fix a valid issue in the puppet-ironic module. We still want to handle
+    upgrades for existing deployments, that's why we manage the ownership change
+    in instack-undercloud.