diff --git a/main/postmarketos-base/APKBUILD b/main/postmarketos-base/APKBUILD
index 6d623a35e..fb6d0d6fc 100644
--- a/main/postmarketos-base/APKBUILD
+++ b/main/postmarketos-base/APKBUILD
@@ -1,6 +1,6 @@
 pkgname=postmarketos-base
 pkgver=32
-pkgrel=2
+pkgrel=3
 pkgdesc="Meta package for minimal postmarketOS base"
 url="https://postmarketos.org"
 arch="noarch"
diff --git a/main/postmarketos-base/postmarketos-base.post-upgrade b/main/postmarketos-base/postmarketos-base.post-upgrade
index 6f670d459..eb158f4c5 100644
--- a/main/postmarketos-base/postmarketos-base.post-upgrade
+++ b/main/postmarketos-base/postmarketos-base.post-upgrade
@@ -43,6 +43,13 @@ ln -sf "$localtime" /etc/localtime
 rm -rf /etc/zoneinfo
 [ "$restart" = "yes" ] && service -qq openrc-settingsd restart
 
+# Fixup old pmOS /etc/fstab installations that had too little options,
+# had a wrong type for fat32 and fat16, and missed some options for vfat when
+# kernels did not use default configs. See pmb!2304
+# This should be safe to remove after some releases, probably v25.06
+sed -i -e "s% /boot \(fat32\|fat16\) defaults 0 0$% /boot vfat umask=0077,nodev,nosuid,noexec,nosymfollow,codepage=437,iocharset=ascii 0 0%g" /etc/fstab
+sed -i -e "s% /boot ext2 defaults 0 0$% /boot ext2 nodev,nosuid,noexec 0 0%g" /etc/fstab
+
 # To turn zram-init into a no-op, set: deviceinfo_zram_swap_pct="0"
 rc-update -q add zram-init default
 # We once enabled tmpfs in default, when it needs bootmisc: pma#2473