diff --git a/net/openswan/Makefile b/net/openswan/Makefile
index ac155c64c..6920a714a 100644
--- a/net/openswan/Makefile
+++ b/net/openswan/Makefile
@@ -97,6 +97,8 @@ define Package/openswan/install
 	rm -rf $(1)/var
 	rm -rf $(1)/etc/rc.d
 	find $(1) -name \*.old | xargs rm -rf
+	$(INSTALL_DIR) $(1)/lib/upgrade/keep.d
+	$(INSTALL_DATA) files/ipsec.upgrade $(1)/lib/upgrade/keep.d/ipsec
 endef
 
 $(eval $(call BuildPackage,openswan))
diff --git a/net/openswan/files/ipsec.upgrade b/net/openswan/files/ipsec.upgrade
new file mode 100644
index 000000000..36ba0c548
--- /dev/null
+++ b/net/openswan/files/ipsec.upgrade
@@ -0,0 +1,3 @@
+/etc/ipsec.conf
+/etc/ipsec.d/
+/etc/ipsec.secrets