Migration from 2026.5.6 to 2026.8.1 fails with message "Major version skips are not allowed."

### Describe the bug

I have Authentik deployed via Podman quadlets. I attempted to upgrade from 2026.5.6 to 2026.8.1 by changing the image spec in the quadlet from:

```
Image=ghcr.io/goauthentik/server:2026.5
```

to:

```
Image=ghcr.io/goauthentik/server:2026.8
```

...and restarted the service. The service failed to start, indicating that I was attempting to upgrade from version 2025.2.4 (which was incorrect) and that major version skips are not allowed.

### How to reproduce

1. Deploy a functional containerized instance of authentik on 2026.5.6.
2. Shut down the old instance of authentik.
3. Deploy a new instance of authentik on 2026.8.1 with the same volume mounts and database.
4. Witness the new instance fail to start, with errors in the logs.

### Expected behavior

The new instance of authentik should successfully migrate the old data and start.

### Screenshots

### Additional context

Running in rootless podman.

### Deployment Method

Other (please specify)

### Version

2026.8.1

### Relevant log output

```shell
Sep 01 13:09:48 ben-server systemd[4094620]: Starting authentik-server.service - authentik - Server...
░░ Subject: A start job for unit UNIT has begun execution
░░ Defined-By: systemd
░░ Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
░░
░░ A start job for unit UNIT has begun execution.
░░
░░ The job identifier is 321778.
Sep 01 13:09:48 ben-server podman[421594]: 2026-09-01 13:09:48.156789788 -0400 EDT m=+0.106721324 container create 117ebeb6c1803799942a99e6d9521b4aa37e75cb385ab5a6bace420f8f750c3d (image=ghcr.io/goauthentik/server:2026.8, name=systemd-authentik-server, pod_id=d314628009fe06e87e479224108fa587934de656fa6bb916a254847127cfd5d6, io.containers.autoupdate=registry, PODMAN_SYSTEMD_UNIT=authentik-server.service, org.opencontainers.image.revision=, org.opencontainers.image.source=https://github.com/goauthentik/authentik, org.opencontainers.image.documentation=https://docs.goauthentik.io, org.opencontainers.image.description=goauthentik.io Main server image, see https://goauthentik.io for more info., org.opencontainers.image.version=2026.8.1, org.opencontainers.image.vendor=Authentik Security Inc., org.opencontainers.image.url=https://goauthentik.io, org.opencontainers.image.authors=Authentik Security Inc., org.opencontainers.image.title=authentik server image, org.opencontainers.image.licenses=https://github.com/goauthentik/authentik/blob/main/LICENSE)
Sep 01 13:09:48 ben-server podman[421594]: 2026-09-01 13:09:48.088768513 -0400 EDT m=+0.038700072 image pull 2c9dd0d4db1136e358544e31a543e8aefbc227fe3bbc5bc279dd4ef8a76a602c ghcr.io/goauthentik/server:2026.8
Sep 01 13:09:48 ben-server podman[421594]: 2026-09-01 13:09:48.307833539 -0400 EDT m=+0.257765099 container init 117ebeb6c1803799942a99e6d9521b4aa37e75cb385ab5a6bace420f8f750c3d (image=ghcr.io/goauthentik/server:2026.8, name=systemd-authentik-server, pod_id=d314628009fe06e87e479224108fa587934de656fa6bb916a254847127cfd5d6, org.opencontainers.image.title=authentik server image, org.opencontainers.image.source=https://github.com/goauthentik/authentik, org.opencontainers.image.version=2026.8.1, io.containers.autoupdate=registry, PODMAN_SYSTEMD_UNIT=authentik-server.service, org.opencontainers.image.vendor=Authentik Security Inc., org.opencontainers.image.url=https://goauthentik.io, org.opencontainers.image.licenses=https://github.com/goauthentik/authentik/blob/main/LICENSE, org.opencontainers.image.revision=, org.opencontainers.image.documentation=https://docs.goauthentik.io, org.opencontainers.image.description=goauthentik.io Main server image, see https://goauthentik.io for more info., org.opencontainers.image.authors=Authentik Security Inc.)
Sep 01 13:09:48 ben-server podman[421594]: 2026-09-01 13:09:48.33271129 -0400 EDT m=+0.282642876 container start 117ebeb6c1803799942a99e6d9521b4aa37e75cb385ab5a6bace420f8f750c3d (image=ghcr.io/goauthentik/server:2026.8, name=systemd-authentik-server, pod_id=d314628009fe06e87e479224108fa587934de656fa6bb916a254847127cfd5d6, org.opencontainers.image.title=authentik server image, org.opencontainers.image.description=goauthentik.io Main server image, see https://goauthentik.io for more info., org.opencontainers.image.version=2026.8.1, io.containers.autoupdate=registry, PODMAN_SYSTEMD_UNIT=authentik-server.service, org.opencontainers.image.url=https://goauthentik.io, org.opencontainers.image.licenses=https://github.com/goauthentik/authentik/blob/main/LICENSE, org.opencontainers.image.revision=, org.opencontainers.image.source=https://github.com/goauthentik/authentik, org.opencontainers.image.documentation=https://docs.goauthentik.io, org.opencontainers.image.vendor=Authentik Security Inc., org.opencontainers.image.authors=Authentik Security Inc.)
Sep 01 13:09:49 ben-server systemd-authentik-server[421616]: {"event": "Loaded config", "level": "debug", "logger": "authentik.lib.config", "timestamp": 1788282589.0745003, "file": "/authentik/lib/default.yml"}
Sep 01 13:09:49 ben-server systemd-authentik-server[421616]: {"event": "Loaded environment variables", "level": "debug", "logger": "authentik.lib.config", "timestamp": 1788282589.0751467, "count": 13}
Sep 01 13:09:49 ben-server systemd-authentik-server[421616]: {"event": "Starting authentik bootstrap", "level": "info", "logger": "authentik.lib.config", "timestamp": 1788282589.0752985}
Sep 01 13:09:49 ben-server systemd-authentik-server[421616]: {"event": "PostgreSQL connection successful", "level": "info", "logger": "authentik.lib.config", "timestamp": 1788282589.0836737}
Sep 01 13:09:49 ben-server systemd-authentik-server[421616]: {"event": "Finished authentik bootstrap", "level": "info", "logger": "authentik.lib.config", "timestamp": 1788282589.0838192}
Sep 01 13:09:49 ben-server systemd-authentik-server[421616]: {"event": "Bootstrap completed", "level": "info", "logger": "bootstrap"}
Sep 01 13:09:49 ben-server systemd-authentik-server[421616]: {"event": "Not running as root, disabling permission fixes", "level": "info", "logger": "bootstrap"}
Sep 01 13:09:49 ben-server systemd-authentik-server[421616]: {"filename":"src/main.rs","level":"info","line_number":53,"pid":2,"target":"authentik","thread_id":"ThreadId(1)","thread_name":"main","timestamp":"2026-09-01T17:09:49.163353","event":"authentik is starting","version":"2026.8.1"}
Sep 01 13:09:49 ben-server systemd-authentik-server[421616]: {"filename":"src/main.rs","level":"trace","line_number":69,"pid":2,"target":"authentik","thread_id":"ThreadId(1)","thread_name":"main","timestamp":"2026-09-01T17:09:49.163706","event":"installing error formatting"}
Sep 01 13:09:49 ben-server systemd-authentik-server[421616]: {"filename":"src/main.rs","level":"trace","line_number":74,"pid":2,"target":"authentik","thread_id":"ThreadId(1)","thread_name":"main","timestamp":"2026-09-01T17:09:49.163760","event":"initializing Python"}
Sep 01 13:09:49 ben-server systemd-authentik-server[421616]: {"filename":"src/main.rs","level":"trace","line_number":76,"pid":2,"target":"authentik","thread_id":"ThreadId(1)","thread_name":"main","timestamp":"2026-09-01T17:09:49.204563","event":"Python initialized"}
Sep 01 13:09:49 ben-server systemd-authentik-server[421616]: {"filename":"packages/ak-common/src/config/mod.rs","level":"info","line_number":192,"pid":2,"target":"authentik_common::config","thread_id":"ThreadId(1)","thread_name":"main","timestamp":"2026-09-01T17:09:49.204587","event":"loading config"}
Sep 01 13:09:49 ben-server systemd-authentik-server[421616]: {"filename":"packages/ak-common/src/config/mod.rs","level":"info","line_number":195,"pid":2,"target":"authentik_common::config","thread_id":"ThreadId(1)","thread_name":"main","timestamp":"2026-09-01T17:09:49.205472","event":"config loaded"}
Sep 01 13:09:49 ben-server systemd-authentik-server[421616]: {"filename":"packages/ak-common/src/tls/mod.rs","level":"trace","line_number":45,"pid":2,"target":"authentik_common::tls","thread_id":"ThreadId(1)","thread_name":"main","timestamp":"2026-09-01T17:09:49.205486","event":"installing rustls crypto provider"}
Sep 01 13:09:49 ben-server systemd-authentik-server[421616]: {"filename":"packages/ak-common/src/config/mod.rs","level":"info","line_number":274,"pid":2,"target":"authentik_common::config","thread_id":"ThreadId(1)","thread_name":"main","timestamp":"2026-09-01T17:09:49.210882","event":"starting config file watcher"}
Sep 01 13:09:49 ben-server systemd-authentik-server[421616]: {"filename":"packages/ak-common/src/arbiter.rs","level":"info","line_number":44,"pid":2,"target":"authentik_common::arbiter","thread_id":"ThreadId(41)","thread_name":"tokio-39","timestamp":"2026-09-01T17:09:49.210930","event":"starting signals watcher"}
Sep 01 13:09:49 ben-server systemd-authentik-server[421616]: {"filename":"src/metrics/mod.rs","level":"info","line_number":42,"pid":2,"target":"authentik::metrics","thread_id":"ThreadId(1)","thread_name":"main","timestamp":"2026-09-01T17:09:49.210947","event":"installing Prometheus recorder"}
Sep 01 13:09:49 ben-server systemd-authentik-server[421616]: {"filename":"packages/ak-common/src/config/mod.rs","level":"info","line_number":237,"pid":2,"target":"authentik_common::config","thread_id":"ThreadId(40)","thread_name":"tokio-38","timestamp":"2026-09-01T17:09:49.211226","event":"config file watcher started","paths":"[]"}
Sep 01 13:09:49 ben-server systemd-authentik-server[421616]: {"filename":"src/metrics/mod.rs","level":"info","line_number":57,"pid":2,"target":"authentik::metrics","thread_id":"ThreadId(40)","thread_name":"tokio-38","timestamp":"2026-09-01T17:09:49.211795","event":"starting metrics upkeep runner"}
Sep 01 13:09:49 ben-server systemd-authentik-server[421616]: {"filename":"packages/ak-common/src/db.rs","level":"info","line_number":74,"pid":2,"target":"authentik_common::db","thread_id":"ThreadId(1)","thread_name":"main","timestamp":"2026-09-01T17:09:49.211848","event":"initializing database pool"}
Sep 01 13:09:49 ben-server systemd-authentik-server[421616]: {"filename":"packages/ak-axum/src/server.rs","level":"info","line_number":81,"pid":2,"target":"authentik_axum::server","thread_id":"ThreadId(40)","thread_name":"tokio-38","timestamp":"2026-09-01T17:09:49.211878","addr":"\"/dev/shm/authentik-metrics.sock\" (pathname)","event":"starting metrics server"}
Sep 01 13:09:49 ben-server systemd-authentik-server[421616]: {"filename":"packages/ak-axum/src/server.rs","level":"info","line_number":28,"pid":2,"target":"authentik_axum::server","thread_id":"ThreadId(41)","thread_name":"tokio-39","timestamp":"2026-09-01T17:09:49.211924","addr":"[::]:9300","event":"starting metrics server"}
Sep 01 13:09:49 ben-server systemd-authentik-server[421616]: {"filename":"packages/ak-common/src/db.rs","level":"info","line_number":115,"pid":2,"target":"authentik_common::db","thread_id":"ThreadId(1)","thread_name":"main","timestamp":"2026-09-01T17:09:49.217756","event":"database pool initialized"}
Sep 01 13:09:49 ben-server systemd-authentik-server[421616]: {"filename":"src/server/mod.rs","level":"info","line_number":87,"pid":2,"target":"authentik::server","thread_id":"ThreadId(1)","thread_name":"main","timestamp":"2026-09-01T17:09:49.217785","event":"starting server"}
Sep 01 13:09:49 ben-server systemd-authentik-server[421616]: {"filename":"packages/ak-common/src/db.rs","level":"info","line_number":53,"pid":2,"target":"authentik_common::db","thread_id":"ThreadId(41)","thread_name":"tokio-39","timestamp":"2026-09-01T17:09:49.217807","event":"starting database watcher for config changes"}
Sep 01 13:09:49 ben-server systemd-authentik-server[421616]: {"filename":"src/server/mod.rs","level":"info","line_number":218,"pid":2,"target":"authentik::server","thread_id":"ThreadId(41)","thread_name":"tokio-39","timestamp":"2026-09-01T17:09:49.372238","event":"starting server watcher"}
Sep 01 13:09:49 ben-server systemd-authentik-server[421616]: {"filename":"packages/ak-axum/src/server.rs","level":"info","line_number":28,"pid":2,"target":"authentik_axum::server","thread_id":"ThreadId(41)","thread_name":"tokio-39","timestamp":"2026-09-01T17:09:49.372600","addr":"[::]:9000","event":"starting server server"}
Sep 01 13:09:49 ben-server systemd-authentik-server[421616]: {"filename":"packages/ak-axum/src/server.rs","level":"info","line_number":134,"pid":2,"target":"authentik_axum::server","thread_id":"ThreadId(2)","thread_name":"tokio-0","timestamp":"2026-09-01T17:09:49.372750","addr":"[::]:9443","event":"starting server server"}
Sep 01 13:09:49 ben-server systemd-authentik-server[421616]: {"filename":"src/server/tls.rs","level":"info","line_number":83,"pid":2,"target":"authentik::server::tls","thread_id":"ThreadId(39)","thread_name":"tokio-37","timestamp":"2026-09-01T17:09:49.372786","event":"waiting for gunicorn to be ready before starting tls watcher"}
Sep 01 13:09:49 ben-server systemd-authentik-server[421616]: {"filename":"packages/ak-axum/src/server.rs","level":"info","line_number":81,"pid":2,"target":"authentik_axum::server","thread_id":"ThreadId(38)","thread_name":"tokio-36","timestamp":"2026-09-01T17:09:49.372874","addr":"\"/dev/shm/authentik.sock\" (pathname)","event":"starting server server"}
Sep 01 13:09:49 ben-server systemd-authentik-server[421616]: {"event": "Loaded config", "level": "debug", "logger": "authentik.lib.config", "timestamp": 1788282589.5458212, "file": "/authentik/lib/default.yml"}
Sep 01 13:09:49 ben-server systemd-authentik-server[421616]: {"event": "Loaded environment variables", "level": "debug", "logger": "authentik.lib.config", "timestamp": 1788282589.5461864, "count": 13}
Sep 01 13:09:50 ben-server systemd-authentik-server[421616]: 2026-09-01 17:09:50 [info ] waiting to acquire database lock
Sep 01 13:09:50 ben-server systemd-authentik-server[421616]: 2026-09-01 17:09:50 [error ] Major version skips are not allowed. See: https://docs.goauthentik.io/install-config/upgrade/?from=2025.2.4&to=2026.8.1 from_version= to_version=
Sep 01 13:09:50 ben-server systemd-authentik-server[421616]: 2026-09-01 17:09:50 [info ] releasing database lock
Sep 01 13:09:50 ben-server systemd-authentik-server[421616]: Failed to read config file: ./lifecycle/gunicorn.conf.py
Sep 01 13:09:50 ben-server systemd-authentik-server[421616]: Traceback (most recent call last):
Sep 01 13:09:50 ben-server systemd-authentik-server[421616]: File "/ak-root/.venv/lib/python3.14/site-packages/gunicorn/app/base.py", line 110, in get_config_from_filename
Sep 01 13:09:50 ben-server systemd-authentik-server[421616]: spec.loader.exec_module(mod)
Sep 01 13:09:50 ben-server systemd-authentik-server[421616]: ~~~~~~~~~~~~~~~~~~~~~~~^^^^^
Sep 01 13:09:50 ben-server systemd-authentik-server[421616]: File "", line 759, in exec_module
Sep 01 13:09:50 ben-server systemd-authentik-server[421616]: File "", line 491, in _call_with_frames_removed
Sep 01 13:09:50 ben-server systemd-authentik-server[421616]: File "/lifecycle/gunicorn.conf.py", line 164, in
Sep 01 13:09:50 ben-server systemd-authentik-server[421616]: run_migrations()
Sep 01 13:09:50 ben-server systemd-authentik-server[421616]: ~~~~~~~~~~~~~~^^
Sep 01 13:09:50 ben-server systemd-authentik-server[421616]: File "/lifecycle/migrate.py", line 135, in run_migrations
Sep 01 13:09:50 ben-server systemd-authentik-server[421616]: ensure_allowed_version(curr)
Sep 01 13:09:50 ben-server systemd-authentik-server[421616]: ~~~~~~~~~~~~~~~~~~~~~~^^^^^^
Sep 01 13:09:50 ben-server systemd-authentik-server[421616]: File "/lifecycle/migrate.py", line 121, in ensure_allowed_version
Sep 01 13:09:50 ben-server systemd-authentik-server[421616]: raise RuntimeError(message)
Sep 01 13:09:50 ben-server systemd-authentik-server[421616]: RuntimeError: Major version skips are not allowed. See: https://docs.goauthentik.io/install-config/upgrade/?from=2025.2.4&to=2026.8.1
Sep 01 13:09:52 ben-server systemd-authentik-server[421616]: {"filename":"packages/ak-common/src/arbiter.rs","level":"info","line_number":68,"pid":2,"target":"authentik_common::arbiter","thread_id":"ThreadId(39)","thread_name":"tokio-37","timestamp":"2026-09-01T17:09:52.548441","event":"signal TERM received"}
Sep 01 13:09:52 ben-server systemd-authentik-server[421616]: {"filename":"packages/ak-common/src/arbiter.rs","level":"info","line_number":257,"pid":2,"target":"authentik_common::arbiter","thread_id":"ThreadId(39)","thread_name":"tokio-37","timestamp":"2026-09-01T17:09:52.548480","event":"arbiter has been told to shutdown gracefully"}
Sep 01 13:09:52 ben-server systemd-authentik-server[421616]: {"filename":"packages/ak-common/src/arbiter.rs","level":"info","line_number":270,"pid":2,"target":"authentik_common::arbiter","thread_id":"ThreadId(39)","thread_name":"tokio-37","timestamp":"2026-09-01T17:09:52.548547","event":"all webservers have been shutdown, shutting down the other tasks gracefully"}
Sep 01 13:09:52 ben-server systemd-authentik-server[421616]: {"filename":"packages/ak-common/src/arbiter.rs","level":"info","line_number":80,"pid":2,"target":"authentik_common::arbiter","thread_id":"ThreadId(39)","thread_name":"tokio-37","timestamp":"2026-09-01T17:09:52.548564","event":"stopping signals watcher"}
Sep 01 13:09:52 ben-server systemd-authentik-server[421616]: {"filename":"src/server/tls.rs","level":"warn","line_number":92,"pid":2,"target":"authentik::server::tls","thread_id":"ThreadId(39)","thread_name":"tokio-37","timestamp":"2026-09-01T17:09:52.548588","event":"we were told to shutdown before starting the tls watcher"}
Sep 01 13:09:52 ben-server systemd-authentik-server[421616]: {"filename":"src/server/mod.rs","level":"info","line_number":134,"pid":2,"target":"authentik::server","thread_id":"ThreadId(39)","thread_name":"tokio-37","timestamp":"2026-09-01T17:09:52.548647","event":"gracefully shutting down server"}
Sep 01 13:09:52 ben-server systemd-authentik-server[421616]: {"filename":"packages/ak-common/src/arbiter.rs","level":"info","line_number":257,"pid":2,"target":"authentik_common::arbiter","thread_id":"ThreadId(1)","thread_name":"main","timestamp":"2026-09-01T17:09:52.548645","event":"arbiter has been told to shutdown gracefully"}
Sep 01 13:09:52 ben-server systemd-authentik-server[421616]: {"filename":"packages/ak-common/src/arbiter.rs","level":"info","line_number":270,"pid":2,"target":"authentik_common::arbiter","thread_id":"ThreadId(1)","thread_name":"main","timestamp":"2026-09-01T17:09:52.548696","event":"all webservers have been shutdown, shutting down the other tasks gracefully"}
Sep 01 13:09:52 ben-server systemd-authentik-server[421616]: {"filename":"packages/ak-common/src/config/mod.rs","level":"info","line_number":265,"pid":2,"target":"authentik_common::config","thread_id":"ThreadId(39)","thread_name":"tokio-37","timestamp":"2026-09-01T17:09:52.548749","event":"stopping config file watcher"}
Sep 01 13:09:52 ben-server systemd-authentik-server[421616]: {"filename":"packages/ak-common/src/db.rs","level":"info","line_number":66,"pid":2,"target":"authentik_common::db","thread_id":"ThreadId(39)","thread_name":"tokio-37","timestamp":"2026-09-01T17:09:52.548792","event":"stopping database watcher for config changes"}
Sep 01 13:09:52 ben-server systemd-authentik-server[421616]: {"filename":"src/main.rs","level":"info","line_number":142,"pid":2,"target":"authentik","thread_id":"ThreadId(1)","thread_name":"main","timestamp":"2026-09-01T17:09:52.548996","event":"authentik exiting"}
Sep 01 13:09:52 ben-server podman[421919]: 2026-09-01 13:09:52.605575413 -0400 EDT m=+0.033016522 container died 117ebeb6c1803799942a99e6d9521b4aa37e75cb385ab5a6bace420f8f750c3d (image=ghcr.io/goauthentik/server:2026.8, name=systemd-authentik-server, PODMAN_SYSTEMD_UNIT=authentik-server.service, io.containers.autoupdate=registry, org.opencontainers.image.description=goauthentik.io Main server image, see https://goauthentik.io for more info., org.opencontainers.image.source=https://github.com/goauthentik/authentik, org.opencontainers.image.title=authentik server image, org.opencontainers.image.revision=, org.opencontainers.image.url=https://goauthentik.io, org.opencontainers.image.authors=Authentik Security Inc., org.opencontainers.image.documentation=https://docs.goauthentik.io, org.opencontainers.image.licenses=https://github.com/goauthentik/authentik/blob/main/LICENSE, org.opencontainers.image.vendor=Authentik Security Inc., org.opencontainers.image.version=2026.8.1)
Sep 01 13:09:52 ben-server podman[421919]: 2026-09-01 13:09:52.994749612 -0400 EDT m=+0.422190737 container remove 117ebeb6c1803799942a99e6d9521b4aa37e75cb385ab5a6bace420f8f750c3d (image=ghcr.io/goauthentik/server:2026.8, name=systemd-authentik-server, pod_id=d314628009fe06e87e479224108fa587934de656fa6bb916a254847127cfd5d6, org.opencontainers.image.description=goauthentik.io Main server image, see https://goauthentik.io for more info., org.opencontainers.image.documentation=https://docs.goauthentik.io, org.opencontainers.image.licenses=https://github.com/goauthentik/authentik/blob/main/LICENSE, org.opencontainers.image.title=authentik server image, org.opencontainers.image.version=2026.8.1, org.opencontainers.image.url=https://goauthentik.io, org.opencontainers.image.authors=Authentik Security Inc., org.opencontainers.image.source=https://github.com/goauthentik/authentik, org.opencontainers.image.vendor=Authentik Security Inc., PODMAN_SYSTEMD_UNIT=authentik-server.service, io.containers.autoupdate=registry, org.opencontainers.image.revision=)
Sep 01 13:09:52 ben-server authentik-server[421594]: Error: container is stopped
Sep 01 13:09:53 ben-server systemd[4094620]: Stopped authentik-server.service - authentik - Server.
░░ Subject: A stop job for unit UNIT has finished
░░ Defined-By: systemd
░░ Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
░░
░░ A stop job for unit UNIT has finished.
░░
░░ The job identifier is 321825 and the job result is done.
Sep 01 13:09:53 ben-server systemd[4094620]: authentik-server.service: Consumed 2.868s CPU time over 5.324s wall clock time, 87.5M memory peak.
░░ Subject: Resources consumed by unit runtime
░░ Defined-By: systemd
░░ Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
░░
░░ The unit UNIT completed and consumed the indicated resources.
```