diff --git a/db/db.rs b/db/db.rs
index 7ebea03..0fffb9b 100644
--- a/db/db.rs
+++ b/db/db.rs
@@ -1824,6 +1824,8 @@ impl LockedDatabase {
 /// test code.
 pub fn init(conn: &mut rusqlite::Connection) -> Result<(), Error> {
     conn.execute("pragma foreign_keys = on", &[] as &[&dyn ToSql])?;
+    conn.execute("pragma fullfsync = on", &[] as &[&dyn ToSql])?;
+    conn.execute("pragma synchronous = 2", &[] as &[&dyn ToSql])?;
     let tx = conn.transaction()?;
     tx.execute_batch(include_str!("schema.sql"))?;
     {
@@ -1885,6 +1887,8 @@ impl<C: Clocks + Clone> Database<C> {
     pub fn new(clocks: C, conn: rusqlite::Connection,
                read_write: bool) -> Result<Database<C>, Error> {
         conn.execute("pragma foreign_keys = on", &[] as &[&dyn ToSql])?;
+        conn.execute("pragma fullfsync = on", &[] as &[&dyn ToSql])?;
+        conn.execute("pragma synchronous = 2", &[] as &[&dyn ToSql])?;
         {
             let ver = get_schema_version(&conn)?.ok_or_else(|| format_err!(
                     "no such table: version. \
diff --git a/db/upgrade/mod.rs b/db/upgrade/mod.rs
index 322cc7f..ca21a16 100644
--- a/db/upgrade/mod.rs
+++ b/db/upgrade/mod.rs
@@ -101,6 +101,10 @@ pub fn run(args: &Args, conn: &mut rusqlite::Connection) -> Result<(), Error> {
     // be careful about the order of operations during the upgrade.
     conn.execute("pragma foreign_keys = on", &[] as &[&dyn ToSql])?;
 
+    // Make the database actually durable.
+    conn.execute("pragma fullfsync = on", &[] as &[&dyn ToSql])?;
+    conn.execute("pragma synchronous = 2", &[] as &[&dyn ToSql])?;
+
     // WAL is the preferred journal mode for normal operation; it reduces the number of syncs
     // without compromising safety.
     set_journal_mode(&conn, "wal").unwrap();