diff --git a/schema/crdb/add-instance-updater-lock/up.sql b/schema/crdb/add-instance-updater-lock/up.sql
new file mode 100644
index 00000000000..76eae1f7231
--- /dev/null
+++ b/schema/crdb/add-instance-updater-lock/up.sql
@@ -0,0 +1,5 @@
+ALTER TABLE omicron.public.instance
+    ADD COLUMN IF NOT EXISTS updater_id UUID
+        DEFAULT null,
+    ADD COLUMN IF NOT EXISTS updater_gen INT
+        NOT NULL DEFAULT 0;
diff --git a/schema/crdb/dbinit.sql b/schema/crdb/dbinit.sql
index e7025f24993..2badb0bb676 100644
--- a/schema/crdb/dbinit.sql
+++ b/schema/crdb/dbinit.sql
@@ -1002,7 +1002,15 @@ CREATE TABLE IF NOT EXISTS omicron.public.instance (
     ncpus INT NOT NULL,
     memory INT NOT NULL,
     hostname STRING(63) NOT NULL,
-    boot_on_fault BOOL NOT NULL DEFAULT false
+    boot_on_fault BOOL NOT NULL DEFAULT false,
+
+    /* ID of the instance update saga that has locked this instance for
+     * updating, if one exists. */
+    updater_id UUID,
+
+    /* Generation of the instance updater lock */
+    updater_gen INT NOT NULL
+
 );
 
 -- Names for instances within a project should be unique