Index: ticket_policy.py
===================================================================
--- ticket_policy.py	(revision 159)
+++ ticket_policy.py	(revision 175)
@@ -1,4 +1,6 @@
+# -*- coding: utf-8 -*-
 from trac.core import *
+from trac.env import IEnvironmentSetupParticipant
 from trac.perm import PermissionCache, IPermissionRequestor, IPermissionGroupProvider, IPermissionPolicy, PermissionSystem
 from trac.ticket.model import Ticket
 from trac.config import IntOption, ListOption
@@ -6,9 +8,37 @@
 
 class InternalTicketsPolicy(Component):
     """Hide internal tickets."""
-    implements(IPermissionPolicy)
+    implements(IPermissionPolicy, IEnvironmentSetupParticipant)
     group_providers = ExtensionPoint(IPermissionGroupProvider)
+    
+    # IEnvironmentSetupParticipant
+    def environment_created(self):
+        if self.environment_needs_upgrade(None):
+            self.upgrade_environment(None)
+    
+    def environment_needs_upgrade(self, db):
+        ticket_custom = "ticket-custom"
+        return not ( self.config.get( ticket_custom, "internal") and \
+                    "InternalTicketsPolicy" in self.config.getlist("trac", "permission_policies"))
+        
+    def upgrade_environment(self, db):
+        ticket_custom = "ticket-custom"
+        if not self.config.get( ticket_custom, "internal"):
+            self.config.set(ticket_custom, "internal", "checkbox")
+            self.config.set(ticket_custom, "internal.value", "0")
+            self.config.set(ticket_custom, "internal.label", "Internal?")
+            self.config.set(ticket_custom,"internal.order", "5")
 
+        if "InternalTicketsPolicy" not in self.config.getlist("trac", "permission_policies"):
+            perms = ["InternalTicketsPolicy"]
+            other_policies = self.config.getlist("trac", "permission_policies")
+            if "DefaultPermissionPolicy" not in other_policies:
+                perms.append("DefaultPermissionPolicy")
+            perms.extend( other_policies )
+            self.config.set("trac", "permission_policies", ', '.join(perms))
+            
+        self.config.save()
+    
     # IPermissionPolicy(Interface)
     def check_permission(self, action, username, resource, perm):
         self.log.debug("Internal: action:%s, user:%s, resource:%s, perm: %s" %
Index: api.py
===================================================================
--- api.py	(revision 159)
+++ api.py	(revision 175)
@@ -159,9 +159,7 @@
                          self.config.get( ticket_custom, "totalhours.order") and \
                          self.config.get( ticket_custom, "hours.order") and \
                          self.config.get( ticket_custom, "estimatedhours.order") and \
-                         self.config.get( ticket_custom, "estimatedhours") and \
-                         self.config.get( ticket_custom, "internal") and \
-                         "InternalTicketsPolicy" in self.config.getlist("trac", "permission_policies"))
+                         self.config.get( ticket_custom, "estimatedhours"))
 
     def do_ticket_field_upgrade(self):
         ticket_custom = "ticket-custom"
@@ -191,20 +189,6 @@
             self.config.set(ticket_custom,"estimatedhours.order", "1")
             self.config.set(ticket_custom,"estimatedhours.label", "Estimated Number of Hours")
 
-        if not self.config.get( ticket_custom, "internal"):
-            self.config.set(ticket_custom, "internal", "checkbox")
-            self.config.set(ticket_custom, "internal.value", "0")
-            self.config.set(ticket_custom, "internal.label", "Internal?")
-            self.config.set(ticket_custom,"internal.order", "5")
-
-        if "InternalTicketsPolicy" not in self.config.getlist("trac", "permission_policies"):
-            perms = ["InternalTicketsPolicy"]
-            other_policies = self.config.getlist("trac", "permission_policies")
-            if "DefaultPermissionPolicy" not in other_policies:
-                perms.append("DefaultPermissionPolicy")
-            perms.extend( other_policies )
-            self.config.set("trac", "permission_policies", ', '.join(perms))
-
         self.config.save();
 
     def needs_user_man(self):
