-- Run only on a portal database installed before the MFA rollout. Backup first.
ALTER TABLE portal_admins
  ADD COLUMN totp_nonce binary(24) NULL,
  ADD COLUMN totp_ciphertext varbinary(128) NULL,
  ADD COLUMN last_totp_step bigint NOT NULL DEFAULT -1;