diff --git a/CHANGELOG.md b/CHANGELOG.md
index c6d4365..0687b48 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+* New command bkctld upgrade-config to move the legacy config file "/etc/evobackup/<jail>" to the new config structure "/etc/evobackup/<jail>.d/incs_policy"
+
 ### Changed
 
 ### Deprecated
diff --git a/bkctld b/bkctld
index 21ee88d..43dc3dc 100755
--- a/bkctld
+++ b/bkctld
@@ -69,7 +69,7 @@ case "${subcommand}" in
             "${LIBDIR}/bkctld-${subcommand}" "${jail_name}" "${option}"
         fi
     ;;
-    "start" | "stop" | "reload" | "restart" | "sync" | "update" | "remove" | "firewall")
+    "start" | "stop" | "reload" | "restart" | "sync" | "update" | "remove" | "firewall" | "upgrade-config")
         jail_name="${2:-}"
         if [ "${jail_name}" = "all" ]; then
             "${LIBDIR}/bkctld-list" | xargs --no-run-if-empty --max-args=1 --max-procs=0 "${LIBDIR}/bkctld-${subcommand}"
diff --git a/lib/bkctld-upgrade-config b/lib/bkctld-upgrade-config
new file mode 100644
index 0000000..59c8e37
--- /dev/null
+++ b/lib/bkctld-upgrade-config
@@ -0,0 +1,47 @@
+#!/bin/sh
+#
+# Update jail <jailname> or all
+# Usage: update <jailname>|all
+#
+
+# shellcheck source=./includes
+LIBDIR="$(dirname $0)" && . "${LIBDIR}/includes"
+
+jail_name="${1:?}"
+if [ ! -n "${jail_name}" ]; then
+    "${LIBDIR}/bkctld-help" && exit 1
+fi
+jail_path=$(jail_path "${jail_name}")
+
+test -d "${jail_path}" || error "${jail_name}: jail not found" 2
+
+legacy_incs_policy_file="${CONFDIR}/${jail_name}"
+incs_policy_file=$(jail_incs_policy_file "${jail_name}")
+
+if [ -h "${legacy_incs_policy_file}" ]; then
+    if [ -f "${incs_policy_file}" ]; then
+        info "${jail_name}: config is already upgraded"
+    else
+        warning "${jail_name}: symlink present but inc policy file \`${incs_policy_file}' not found"
+    fi
+elif [ ! -e "${legacy_incs_policy_file}" ] ; then
+    if [ -f "${incs_policy_file}" ]; then
+        # create a symlink for backward compatibility
+        ln -s "${incs_policy_file}" "${legacy_incs_policy_file}"
+
+        info "${jail_name}: config has been symlinked"
+    else
+        warning "${jail_name}: inc policy file \`${incs_policy_file}' not found"
+    fi
+elif [ -f "${legacy_incs_policy_file}" ]; then
+    # Create directory if missing
+    mkdir -p "$(jail_config_dir "${jail_name}")"
+    # move the main config file
+    mv "${legacy_incs_policy_file}" "${incs_policy_file}"
+    # create a symlink for backward compatibility
+    ln -s "${incs_policy_file}" "${legacy_incs_policy_file}"
+    # create a check_policy file if missing
+    touch "$(jail_check_policy_file "${jail_name}")"
+
+    info "${jail_name}: config has been upgraded"
+fi