diff --git a/nexus/db-model/src/schema_versions.rs b/nexus/db-model/src/schema_versions.rs
index 9ec1c6b7b3..c4510c02be 100644
--- a/nexus/db-model/src/schema_versions.rs
+++ b/nexus/db-model/src/schema_versions.rs
@@ -17,7 +17,7 @@ use std::collections::BTreeMap;
 ///
 /// This must be updated when you change the database schema.  Refer to
 /// schema/crdb/README.adoc in the root of this repository for details.
-pub const SCHEMA_VERSION: SemverVersion = SemverVersion::new(58, 0, 0);
+pub const SCHEMA_VERSION: SemverVersion = SemverVersion::new(59, 0, 0);
 
 /// List of all past database schema versions, in *reverse* order
 ///
@@ -29,6 +29,7 @@ static KNOWN_VERSIONS: Lazy<Vec<KnownVersion>> = Lazy::new(|| {
         // |  leaving the first copy as an example for the next person.
         // v
         // KnownVersion::new(next_int, "unique-dirname-with-the-sql-files"),
+        KnownVersion::new(59, "enforce-first-as-default"),
         KnownVersion::new(58, "insert-default-allowlist"),
         KnownVersion::new(57, "add-allowed-source-ips"),
         KnownVersion::new(56, "bgp-oxpop-features"),
diff --git a/schema/crdb/dbinit.sql b/schema/crdb/dbinit.sql
index 0c5b557a58..e77b7b81ef 100644
--- a/schema/crdb/dbinit.sql
+++ b/schema/crdb/dbinit.sql
@@ -2637,7 +2637,7 @@ CREATE TABLE IF NOT EXISTS omicron.public.switch_port_settings_bgp_peer_config (
     md5_auth_key TEXT,
     multi_exit_discriminator INT8,
     local_pref INT8,
-    enforce_first_as BOOLEAN,
+    enforce_first_as BOOLEAN NOT NULL DEFAULT false,
     allow_import_list_active BOOLEAN NOT NULL DEFAULT false,
     allow_export_list_active BOOLEAN NOT NULL DEFAULT false,
     vlan_id INT4,
@@ -3842,7 +3842,7 @@ INSERT INTO omicron.public.db_metadata (
     version,
     target_version
 ) VALUES
-    (TRUE, NOW(), NOW(), '58.0.0', NULL)
+    (TRUE, NOW(), NOW(), '59.0.0', NULL)
 ON CONFLICT DO NOTHING;
 
 COMMIT;
diff --git a/schema/crdb/enforce-first-as-default/up01.sql b/schema/crdb/enforce-first-as-default/up01.sql
new file mode 100644
index 0000000000..c1952a2df6
--- /dev/null
+++ b/schema/crdb/enforce-first-as-default/up01.sql
@@ -0,0 +1 @@
+ALTER TABLE omicron.public.switch_port_settings_bgp_peer_config ALTER COLUMN enforce_first_as SET DEFAULT false;
diff --git a/schema/crdb/enforce-first-as-default/up02.sql b/schema/crdb/enforce-first-as-default/up02.sql
new file mode 100644
index 0000000000..ff6e96ba0f
--- /dev/null
+++ b/schema/crdb/enforce-first-as-default/up02.sql
@@ -0,0 +1,5 @@
+set local disallow_full_table_scans = off;
+
+UPDATE omicron.public.switch_port_settings_bgp_peer_config
+    SET enforce_first_as = false
+    WHERE enforce_first_as IS NULL;
diff --git a/schema/crdb/enforce-first-as-default/up03.sql b/schema/crdb/enforce-first-as-default/up03.sql
new file mode 100644
index 0000000000..2ccd0220df
--- /dev/null
+++ b/schema/crdb/enforce-first-as-default/up03.sql
@@ -0,0 +1 @@
+ALTER TABLE omicron.public.switch_port_settings_bgp_peer_config ALTER COLUMN enforce_first_as SET NOT NULL;