diff --git a/CRM/Core/ManagedEntities.php b/CRM/Core/ManagedEntities.php
index a3883286963a..cf47fa6918bd 100644
--- a/CRM/Core/ManagedEntities.php
+++ b/CRM/Core/ManagedEntities.php
@@ -112,10 +112,15 @@ public function get($moduleName, $name) {
   /**
    * Identify any enabled/disabled modules. Add new entities, update
    * existing entities, and remove orphaned (stale) entities.
+   * @param bool $ignoreUpgradeMode
    *
    * @throws Exception
    */
-  public function reconcile() {
+  public function reconcile($ignoreUpgradeMode = FALSE) {
+    // Do not reconcile whilst we are in upgrade mode
+    if (CRM_Core_Config::singleton()->isUpgradeMode() && !$ignoreUpgradeMode) {
+      return;
+    }
     if ($error = $this->validate($this->getDeclarations())) {
       throw new Exception($error);
     }
diff --git a/CRM/Upgrade/Form.php b/CRM/Upgrade/Form.php
index 8c23bbbb03ef..4d9f5ea5f55e 100644
--- a/CRM/Upgrade/Form.php
+++ b/CRM/Upgrade/Form.php
@@ -794,6 +794,8 @@ public static function doFinish() {
     // Rebuild all triggers and re-enable logging if needed
     $logging = new CRM_Logging_Schema();
     $logging->fixSchemaDifferences();
+
+    CRM_Core_ManagedEntities::singleton(TRUE)->reconcile(TRUE);
   }
 
   /**
diff --git a/CRM/Utils/Hook.php b/CRM/Utils/Hook.php
index b84ec7ac8713..1491da33e263 100644
--- a/CRM/Utils/Hook.php
+++ b/CRM/Utils/Hook.php
@@ -160,7 +160,7 @@ public function invoke(
     // Instead of not calling any hooks we only call those we know to be frequently important - if a particular extension wanted
     // to avoid this they could do an early return on CRM_Core_Config::singleton()->isUpgradeMode
     // Futther discussion is happening at https://lab.civicrm.org/dev/core/issues/1460
-    $upgradeFriendlyHooks = ['civicrm_alterSettingsFolders', 'civicrm_alterSettingsMetaData', 'civicrm_triggerInfo', 'civicrm_alterLogTables', 'civicrm_container'];
+    $upgradeFriendlyHooks = ['civicrm_alterSettingsFolders', 'civicrm_alterSettingsMetaData', 'civicrm_triggerInfo', 'civicrm_alterLogTables', 'civicrm_container', 'civicrm_permission'];
     if (CRM_Core_Config::singleton()->isUpgradeMode() && !in_array($fnSuffix, $upgradeFriendlyHooks)) {
       return;
     }