diff --git a/models/forgejo_migrations/v25.go b/models/forgejo_migrations/v25.go
index 2e9641929c..e2316007cf 100644
--- a/models/forgejo_migrations/v25.go
+++ b/models/forgejo_migrations/v25.go
@@ -20,9 +20,34 @@ import (
 func MigrateTwoFactorToKeying(x *xorm.Engine) error {
 	var err error
 
+	// When upgrading from Forgejo v9 to v10, this migration will already be
+	// called from models/migrations/migrations.go migration 304 and must not
+	// be run twice.
+	var version int
+	_, err = x.Table("version").Where("`id` = 1").Select("version").Get(&version)
+	if err != nil {
+		// the version table does not exist when a test environment only applies Forgejo migrations
+	} else if version > 304 {
+		return nil
+	}
+
 	switch x.Dialect().URI().DBType {
 	case schemas.MYSQL:
 		_, err = x.Exec("ALTER TABLE `two_factor` MODIFY `secret` BLOB")
+	case schemas.SQLITE:
+		_, err = x.Exec("ALTER TABLE `two_factor` RENAME COLUMN `secret` TO `secret_backup`")
+		if err != nil {
+			return err
+		}
+		_, err = x.Exec("ALTER TABLE `two_factor` ADD COLUMN `secret` BLOB")
+		if err != nil {
+			return err
+		}
+		_, err = x.Exec("UPDATE `two_factor` SET `secret` = `secret_backup`")
+		if err != nil {
+			return err
+		}
+		_, err = x.Exec("ALTER TABLE `two_factor` DROP COLUMN `secret_backup`")
 	case schemas.POSTGRES:
 		_, err = x.Exec("ALTER TABLE `two_factor` ALTER COLUMN `secret` SET DATA TYPE bytea USING secret::text::bytea")
 	}
diff --git a/models/migrations/migrations.go b/models/migrations/migrations.go
index 77a97fb3f6..1674af08cd 100644
--- a/models/migrations/migrations.go
+++ b/models/migrations/migrations.go
@@ -362,6 +362,10 @@ func prepareMigrationTasks() []*migration {
 		newMigration(300, "Add force-push branch protection support", v1_23.AddForcePushBranchProtection),
 		newMigration(301, "Add skip_secondary_authorization option to oauth2 application table", v1_23.AddSkipSecondaryAuthColumnToOAuth2ApplicationTable),
 		newMigration(302, "Add index to action_task stopped log_expired", v1_23.AddIndexToActionTaskStoppedLogExpired),
+
+		// Migration to Forgejo v10
+		newMigration(303, "Gitea last drop", v1_23.GiteaLastDrop),
+		newMigration(304, "Migrate `secret` column to store keying material", forgejo_migrations.MigrateTwoFactorToKeying),
 	}
 	return preparedMigrations
 }
diff --git a/models/migrations/v1_23/v303.go b/models/migrations/v1_23/v303.go
new file mode 100644
index 0000000000..c1e74c596a
--- /dev/null
+++ b/models/migrations/v1_23/v303.go
@@ -0,0 +1,33 @@
+// Copyright 2024 The Forgejo Authors.
+// SPDX-License-Identifier: MIT
+
+package v1_23 //nolint
+
+import (
+	"code.gitea.io/gitea/models/migrations/base"
+
+	"xorm.io/xorm"
+)
+
+func GiteaLastDrop(x *xorm.Engine) error {
+	sess := x.NewSession()
+	defer sess.Close()
+
+	if err := base.DropTableColumns(sess, "badge", "slug"); err != nil {
+		return err
+	}
+	if err := base.DropTableColumns(sess, "oauth2_application", "skip_secondary_authorization"); err != nil {
+		return err
+	}
+	if err := base.DropTableColumns(sess, "repository", "default_wiki_branch"); err != nil {
+		return err
+	}
+	// the migration v297.go that adds everyone_access_mode exists in Gitea >= v1.22 and the column must be dropped
+	// but it does not exist in Forgejo and a failure to drop the column can be ignored
+	base.DropTableColumns(sess, "repo_unit", "everyone_access_mode")
+	if err := base.DropTableColumns(sess, "protected_branch", "can_force_push", "enable_force_push_allowlist", "force_push_allowlist_user_i_ds", "force_push_allowlist_team_i_ds", "force_push_allowlist_deploy_keys"); err != nil {
+		return err
+	}
+
+	return sess.Commit()
+}
diff --git a/models/system/setting.go b/models/system/setting.go
index 4472b4c228..cda60d1758 100644
--- a/models/system/setting.go
+++ b/models/system/setting.go
@@ -18,10 +18,10 @@ import (
 )
 
 type Setting struct {
-	ID           int64              `xorm:"pk autoincr"`
-	SettingKey   string             `xorm:"varchar(255) unique"` // key should be lowercase
-	SettingValue string             `xorm:"text"`
-	Version      int                `xorm:"version"`
+	ID           int64  `xorm:"pk autoincr"`
+	SettingKey   string `xorm:"varchar(255) unique"` // key should be lowercase
+	SettingValue string `xorm:"text"`
+	Version      int
 	Created      timeutil.TimeStamp `xorm:"created"`
 	Updated      timeutil.TimeStamp `xorm:"updated"`
 }