diff --git a/db_scripts/diff/15325.down b/db_scripts/diff/15325.down
new file mode 100644
index 00000000..4312417a
--- /dev/null
+++ b/db_scripts/diff/15325.down
@@ -0,0 +1,3 @@
+-- there is no down possibility here, as once active,
+-- we null out the old md5pass column with no way to
+-- return to the previous stage
diff --git a/db_scripts/diff/15325.up b/db_scripts/diff/15325.up
new file mode 100644
index 00000000..e36a0f72
--- /dev/null
+++ b/db_scripts/diff/15325.up
@@ -0,0 +1,6 @@
+USE billing;
+
+ALTER TABLE admins ADD COLUMN saltedpass CHAR(54) DEFAULT NULL AFTER md5pass;
+
+-- clear all stored client certs
+UPDATE admins SET ssl_client_certificate = NULL;