diff --git a/xCAT-server/lib/perl/xCAT/SvrUtils.pm b/xCAT-server/lib/perl/xCAT/SvrUtils.pm
index 87c95f0df..5ac63fca1 100644
--- a/xCAT-server/lib/perl/xCAT/SvrUtils.pm
+++ b/xCAT-server/lib/perl/xCAT/SvrUtils.pm
@@ -2640,6 +2640,33 @@ sub rootimg_checksum_enabled {
     return !(defined($value) && $value =~ /^\s*(?:no|0)\s*$/ix);
 }
 
+#--------------------------------------------------------------------------------------------------------
+#upgrade_rootimg_checksum:
+#description: on an upgrade from a release without the root image check, keep the stateless and statelite
+#             ramdisk images of that release unchecked, and give new images the check. While
+#             site.rootimgchecksum is not set, set the rootimgchecksum attribute to no for each such image
+#             that does not set it, then set site.rootimgchecksum to yes. A later upgrade changes nothing.
+#return:
+#        nothing, or the error message
+#--------------------------------------------------------------------------------------------------------
+sub upgrade_rootimg_checksum {
+    my ($class) = @_;
+    my $sitetab = xCAT::Table->new('site', -create => 1) or return 'Cannot open the site table';
+    my ($site) = $sitetab->getAttribs({ key => 'rootimgchecksum' }, 'value');
+    return if $site && defined($site->{value}) && $site->{value} ne '';
+    my $osimagetab    = xCAT::Table->new('osimage',    -create => 1) or return 'Cannot open the osimage table';
+    my $linuximagetab = xCAT::Table->new('linuximage', -create => 1) or return 'Cannot open the linuximage table';
+    my %decided = map { ($_->{imagename} => 1) } grep { defined($_->{rootimgchecksum}) && $_->{rootimgchecksum} ne '' }
+      $linuximagetab->getAllAttribs('imagename', 'rootimgchecksum');
+    foreach my $image ($osimagetab->getAllAttribs('imagename', 'provmethod')) {
+        next if $decided{ $image->{imagename} } || ($image->{provmethod} // '') !~ /^(?:netboot|statelite)$/x;
+        my (undef, $image_error) = $linuximagetab->setAttribs({ imagename => $image->{imagename} }, { rootimgchecksum => 'no' });
+        return "Cannot turn the root image check off for $image->{imagename}: $image_error" if $image_error;
+    }
+    my (undef, $site_error) = $sitetab->setAttribs({ key => 'rootimgchecksum' }, { value => 'yes' });
+    return $site_error ? "Cannot set site.rootimgchecksum: $site_error" : undef;
+}
+
 #--------------------------------------------------------------------------------------------------------
 #write_initrd_check_marker:
 #description: record that an initial ramdisk checks the compressed rootimage against its checksum.
diff --git a/xCAT-server/sbin/xcatconfig b/xCAT-server/sbin/xcatconfig
index 81010a53c..4f83d4a4d 100755
--- a/xCAT-server/sbin/xcatconfig
+++ b/xCAT-server/sbin/xcatconfig
@@ -471,6 +471,10 @@ if ($::INITIALINSTALL || $::FORCE || $::UPDATEINSTALL || $::genCredentials)
 
 if ($::UPDATEINSTALL) {
     upgrade_conserver();
+
+    # The images of a release without the root image check keep booting unchecked.
+    my $error = xCAT::SvrUtils->upgrade_rootimg_checksum();
+    xCAT::MsgUtils->message('E', $error) if $error;
 }
 
 # more  config needed after xcatd start
@@ -1261,6 +1265,9 @@ sub initDB
         $chtabcmds .= "$::XCATROOT/sbin/chtab key=vsftp site.value=n;";
         $chtabcmds .= "$::XCATROOT/sbin/chtab key=cleanupxcatpost site.value=no;";
         $chtabcmds .= "$::XCATROOT/sbin/chtab key=cleanupdiskfullxcatpost site.value=no;";
+
+        # New images get the root image check, and a later upgrade keeps it.
+        $chtabcmds .= "$::XCATROOT/sbin/chtab key=rootimgchecksum site.value=yes;";
         my $omapi_algorithm =
           xCAT::DHCP::OmapiPolicy->new_install_default_algorithm(
             is_new_install => $initializing_new_site,