diff --git a/models/forgejo_migrations/v25.go b/models/forgejo_migrations/v25.go
index 2e9641929c..e2316007cf 100644
--- a/models/forgejo_migrations/v25.go
+++ b/models/forgejo_migrations/v25.go
@@ -20,9 +20,34 @@ import (
 func MigrateTwoFactorToKeying(x *xorm.Engine) error {
 	var err error
 
+	// When upgrading from Forgejo v9 to v10, this migration will already be
+	// called from models/migrations/migrations.go migration 304 and must not
+	// be run twice.
+	var version int
+	_, err = x.Table("version").Where("`id` = 1").Select("version").Get(&version)
+	if err != nil {
+		// the version table does not exist when a test environment only applies Forgejo migrations
+	} else if version > 304 {
+		return nil
+	}
+
 	switch x.Dialect().URI().DBType {
 	case schemas.MYSQL:
 		_, err = x.Exec("ALTER TABLE `two_factor` MODIFY `secret` BLOB")
+	case schemas.SQLITE:
+		_, err = x.Exec("ALTER TABLE `two_factor` RENAME COLUMN `secret` TO `secret_backup`")
+		if err != nil {
+			return err
+		}
+		_, err = x.Exec("ALTER TABLE `two_factor` ADD COLUMN `secret` BLOB")
+		if err != nil {
+			return err
+		}
+		_, err = x.Exec("UPDATE `two_factor` SET `secret` = `secret_backup`")
+		if err != nil {
+			return err
+		}
+		_, err = x.Exec("ALTER TABLE `two_factor` DROP COLUMN `secret_backup`")
 	case schemas.POSTGRES:
 		_, err = x.Exec("ALTER TABLE `two_factor` ALTER COLUMN `secret` SET DATA TYPE bytea USING secret::text::bytea")
 	}
diff --git a/models/migrations/migrations.go b/models/migrations/migrations.go
index 1c55bcd63d..1674af08cd 100644
--- a/models/migrations/migrations.go
+++ b/models/migrations/migrations.go
@@ -365,6 +365,7 @@ func prepareMigrationTasks() []*migration {
 
 		// Migration to Forgejo v10
 		newMigration(303, "Gitea last drop", v1_23.GiteaLastDrop),
+		newMigration(304, "Migrate `secret` column to store keying material", forgejo_migrations.MigrateTwoFactorToKeying),
 	}
 	return preparedMigrations
 }