diff --git a/keystone/common/sql/contract_repo/versions/036_contract_rename_application_credential_restriction_column.py b/keystone/common/sql/contract_repo/versions/036_contract_rename_application_credential_restriction_column.py
index 8ecdf881fc..f8ef7e1a78 100644
--- a/keystone/common/sql/contract_repo/versions/036_contract_rename_application_credential_restriction_column.py
+++ b/keystone/common/sql/contract_repo/versions/036_contract_rename_application_credential_restriction_column.py
@@ -28,5 +28,13 @@ def upgrade(migrate_engine):
         new_table.rename('application_credential')
     else:
         table = application_credential_table
+        # NOTE(cmurphy) because of lb#1744948, some deployments could already
+        # have made it past the expand step and be stuck on the contract step.
+        # If necessary, do the expand step here.
+        # At this point this API is not yet exposed and there should be no data
+        # in this table.
+        if 'unrestricted' not in table.columns:
+            unrestricted = sql.Column('unrestricted', sql.Boolean())
+            table.create_column(unrestricted)
         column = table.c.allow_application_credential_creation
-        column.alter(name='unrestricted')
+        column.drop()
diff --git a/keystone/common/sql/expand_repo/versions/036_expand_rename_application_credential_restriction_column.py b/keystone/common/sql/expand_repo/versions/036_expand_rename_application_credential_restriction_column.py
index 67310ab893..5d5b3ef063 100644
--- a/keystone/common/sql/expand_repo/versions/036_expand_rename_application_credential_restriction_column.py
+++ b/keystone/common/sql/expand_repo/versions/036_expand_rename_application_credential_restriction_column.py
@@ -18,13 +18,14 @@ def upgrade(migrate_engine):
     meta = sql.MetaData()
     meta.bind = migrate_engine
 
+    table = sql.Table(
+        'application_credential', meta, autoload=True
+    )
     # MySQL and PostgreSQL can handle a column rename.
     # Only Sqlite is special. Since Sqlite can't support an online upgrade
     # anyway, just brute-force the migration by copying the table.
     if migrate_engine.name == 'sqlite':
-        old_table = sql.Table(
-            'application_credential', meta, autoload=True
-        )
+        old_table = table
 
         args = []
         for column in old_table.columns:
@@ -38,3 +39,6 @@ def upgrade(migrate_engine):
         new_table = sql.Table('application_credential_temp',
                               old_table.metadata, *args)
         new_table.create(migrate_engine, checkfirst=True)
+    else:
+        unrestricted = sql.Column('unrestricted', sql.Boolean())
+        table.create_column(unrestricted)