diff --git a/manifests/database/postgresql.pp b/manifests/database/postgresql.pp
index d351867..423fb0d 100644
--- a/manifests/database/postgresql.pp
+++ b/manifests/database/postgresql.pp
@@ -54,7 +54,7 @@
       default => ''
     }
 
-    exec { 'cpdb':
+    exec { 'cpdb create':
       path    => '/usr/share/candlepin:/bin',
       command => "cpdb --create \
                        --schema-only \
@@ -66,12 +66,25 @@
                        >> ${log_dir}/cpdb.log \
                        2>&1 && touch /var/lib/candlepin/cpdb_done",
       creates => '/var/lib/candlepin/cpdb_done',
-      before  => Service['tomcat'],
       require => Concat['/etc/candlepin/candlepin.conf'],
+    } ->
+
+    exec { 'cpdb update':
+      path    => '/usr/share/candlepin:/bin',
+      command => "cpdb --update \
+                       --dbhost=${db_host} \
+                       --dbport=${db_port} \
+                       --database='${db_name}${ssl_options}' \
+                       --user='${db_user}'  \
+                       --password='${db_password}' \
+                       >> ${log_dir}/cpdb.log \
+                       2>&1 && touch /var/lib/candlepin/cpdb_update_done",
+      creates => '/var/lib/candlepin/cpdb_update_done',
     }
+
     # if both manage_db and init_db enforce order of resources
     if $manage_db {
-      Postgresql::Server::Db[$db_name] -> Exec['cpdb']
+      Postgresql::Server::Db[$db_name] -> Exec['cpdb create']
     }
   }
 }
diff --git a/spec/classes/candlepin_spec.rb b/spec/classes/candlepin_spec.rb
index 2e6e140..264d807 100644
--- a/spec/classes/candlepin_spec.rb
+++ b/spec/classes/candlepin_spec.rb
@@ -53,7 +53,16 @@
         # database
         it { is_expected.not_to contain_class('candlepin::database::mysql') }
         it { is_expected.to contain_class('candlepin::database::postgresql') }
-        it { is_expected.to contain_exec('cpdb').that_subscribes_to('Package[candlepin]').that_comes_before('Service[tomcat]') }
+        it 'migrates the database' do
+          is_expected.to contain_exec('cpdb create')
+            .that_subscribes_to(['Package[candlepin]', 'Concat[/etc/candlepin/candlepin.conf]'])
+            .that_requires('Postgresql::Server::Db[candlepin]')
+            .that_notifies('Service[tomcat]')
+          is_expected.to contain_exec('cpdb update')
+            .that_subscribes_to(['Package[candlepin]', 'Concat[/etc/candlepin/candlepin.conf]'])
+            .that_requires('Exec[cpdb create]')
+            .that_notifies('Service[tomcat]')
+        end
         it { is_expected.to contain_postgresql__server__db('candlepin') }
         it { is_expected.to contain_postgresql__server__role('candlepin').that_comes_before('Postgresql::Server::Database[candlepin]') }