diff --git a/packages/ns-threat_shield/Makefile b/packages/ns-threat_shield/Makefile
index 57740c7ca..d122b98cd 100644
--- a/packages/ns-threat_shield/Makefile
+++ b/packages/ns-threat_shield/Makefile
@@ -64,7 +64,8 @@ define Package/ns-threat_shield/install
 	$(INSTALL_DIR) $(1)/etc/uci-defaults
 	$(INSTALL_BIN) ./files/banip-defaults $(1)/etc/uci-defaults/99-nethsec-banip
 	$(INSTALL_BIN) ./files/banip-extra-defaults $(1)/etc/uci-defaults/96-nethsec-banip-extra
-	$(INSTALL_BIN) ./files/banip-insights-defaults $(1)/etc/uci-defaults/97-nethsec-banip-insights
+	$(INSTALL_BIN) ./files/97-nethsec-banip-feeds $(1)/etc/uci-defaults/97-nethsec-banip-feeds
+	$(INSTALL_BIN) ./files/banip-insights-defaults $(1)/etc/uci-defaults/98-nethsec-banip-insights
 	$(INSTALL_BIN) ./files/35_ns-threat_shield $(1)/etc/uci-defaults/35_ns-threat_shield
 	$(INSTALL_BIN) ./files/96_ns-threat_shield $(1)/etc/uci-defaults/96_ns-threat_shield
 	gzip -9n $(1)/usr/share/threat_shield/nethesis-dns.sources
@@ -74,8 +75,7 @@ endef
 define Package/ns-threat_shield/postinst
 #!/bin/sh
 if [ -z "$${IPKG_INSTROOT}" ]; then
-  (. /etc/uci-defaults/20_threat_shield)
-  rm -f /etc/uci-defaults/20_threat_shield
+  /etc/init.d/banip reload
   /etc/init.d/rsyslog restart
   /etc/init.d/cron restart
 fi
diff --git a/packages/ns-threat_shield/files/97-nethsec-banip-feeds b/packages/ns-threat_shield/files/97-nethsec-banip-feeds
new file mode 100644
index 000000000..3a68fa012
--- /dev/null
+++ b/packages/ns-threat_shield/files/97-nethsec-banip-feeds
@@ -0,0 +1,20 @@
+#!/bin/sh
+
+#
+# Copyright (C) 2026 Nethesis S.r.l.
+# SPDX-License-Identifier: GPL-2.0-only
+#
+
+# Rebuild the enterprise feeds left in the banIP 1.0 format (rule_4) by an upgrade.
+# apk can install banip before ns-threat_shield: 95-banip-housekeeping then runs ts-ip
+# with the old banip.nethesis.feeds, and banIP skips the enterprise feeds as incomplete.
+# If banip.feeds is still in the old format banip is not updated yet, and its own
+# housekeeping rebuilds the file later.
+# The postinst reloads banIP after all the uci-defaults.
+
+grep -q '"rule_4"' /etc/banip/banip.custom.feeds 2>/dev/null || exit 0
+grep -q '"rule_4"' /etc/banip/banip.feeds && exit 0
+
+/usr/sbin/ts-ip
+
+exit 0