diff --git a/changes/installer-keeps-store.md b/changes/installer-keeps-store.md
new file mode 100644
index 00000000..f5c969c8
--- /dev/null
+++ b/changes/installer-keeps-store.md
@@ -0,0 +1,6 @@
+bump: patch
+type: fix
+An upgrade keeps the package store. The installer replaces the whole install
+root, and `ludic add` caches packages in `~/.ludic/store` — so re-running the
+one-liner deleted every package a project had fetched. The store is carried
+across now; everything else in the root belongs to the toolchain and is replaced.
diff --git a/install.sh b/install.sh
index dadf09e2..a098427c 100755
--- a/install.sh
+++ b/install.sh
@@ -182,6 +182,13 @@ install_staged() {
   if [ -d "$INSTALL_DIR" ]; then
     rm -rf "${INSTALL_DIR}.old"
     mv "$INSTALL_DIR" "${INSTALL_DIR}.old"
+    # The install root is not only the artifact: `ludic add` caches packages in
+    # <root>/store, which is the user's data and takes a network round trip to
+    # rebuild. Carry it across rather than replacing the directory out from under
+    # it. (Anything else here is part of the toolchain and should be replaced.)
+    if [ -d "${INSTALL_DIR}.old/store" ]; then
+      mv "${INSTALL_DIR}.old/store" "${_staged}/store" || warn "could not carry the package store across"
+    fi
   fi
   mv "$_staged" "$INSTALL_DIR"
   rm -rf "${INSTALL_DIR}.old"