diff --git a/lib/common.sh b/lib/common.sh
index 7daffe68..e88a9bcd 100644
--- a/lib/common.sh
+++ b/lib/common.sh
@@ -788,7 +788,12 @@ function git_fetch_helper() {
 		label='[token passed]'
 	fi
 	echo "Running: $label git fetch $orig_url $*"
-	git fetch "$git_url" "$@" || die "git fetch failed"
+	#
+	# Don't die here; logmust callers still fail-hard via logmust's own
+	# error handling, while non-logmust callers (e.g. fetch_repo_from_git's
+	# upstream-branch bootstrap fallback) can react to the failure.
+	#
+	git fetch "$git_url" "$@"
 }
 
 #
@@ -827,8 +832,30 @@ function fetch_repo_from_git() {
 	if [[ "$DO_UPDATE_PACKAGE" == "true" ]]; then
 		logmust git_fetch_helper "$PACKAGE_GIT_URL" --no-tags \
 			"+$PACKAGE_GIT_BRANCH:repo-HEAD"
-		logmust git_fetch_helper "$PACKAGE_GIT_URL" --no-tags \
-			"+upstreams/$DEFAULT_GIT_BRANCH:upstream-HEAD"
+		#
+		# Try to fetch the upstream-tracking branch from the package's
+		# own repository. If it doesn't exist yet -- first time the
+		# package is being synced -- bootstrap upstream-HEAD directly
+		# from the third-party upstream specified by UPSTREAM_GIT_URL /
+		# UPSTREAM_GIT_BRANCH, and mark upstream-updated so
+		# sync-with-upstream.sh pushes upstream-HEAD back to origin,
+		# creating the upstreams/<branch> branch in the process.
+		#
+		if git_fetch_helper "$PACKAGE_GIT_URL" --no-tags \
+			"+upstreams/$DEFAULT_GIT_BRANCH:upstream-HEAD"; then
+			:
+		elif [[ -n "$UPSTREAM_GIT_URL" && -n "$UPSTREAM_GIT_BRANCH" ]]; then
+			echo "NOTE: upstreams/$DEFAULT_GIT_BRANCH does not exist" \
+				"on $PACKAGE_GIT_URL; bootstrapping upstream-HEAD" \
+				"from $UPSTREAM_GIT_URL ($UPSTREAM_GIT_BRANCH)."
+			logmust git_fetch_helper "$UPSTREAM_GIT_URL" --no-tags \
+				"+$UPSTREAM_GIT_BRANCH:upstream-HEAD"
+			logmust touch "$WORKDIR/upstream-updated"
+		else
+			die "Failed to fetch upstreams/$DEFAULT_GIT_BRANCH from" \
+				"$PACKAGE_GIT_URL and UPSTREAM_GIT_URL/" \
+				"UPSTREAM_GIT_BRANCH are not set to bootstrap from."
+		fi
 		logmust git show-ref repo-HEAD
 		logmust git show-ref upstream-HEAD
 	else
diff --git a/packages/sdb/config.sh b/packages/sdb/config.sh
index b6430637..3b36fed4 100644
--- a/packages/sdb/config.sh
+++ b/packages/sdb/config.sh
@@ -18,10 +18,27 @@
 # shellcheck disable=SC2034
 DEFAULT_PACKAGE_GIT_URL="https://github.com/delphix/sdb.git"
 
+UPSTREAM_GIT_URL="https://github.com/sdimitro/sdb.git"
+UPSTREAM_GIT_BRANCH="develop"
+
 function prepare() {
 	logmust install_build_deps_from_control_file
 }
 
 function build() {
+	local scm_version
+	scm_version=$(cd "$WORKDIR/repo" && python3 -m setuptools_scm 2>/dev/null) ||
+		die "setuptools_scm version derivation failed"
+	#
+	# pyproject.toml sets local_scheme="no-local-version", so the value
+	# is debian-version-safe. Pass it through as-is; linux-pkg's
+	# set_changelog appends "-1delphix.<ts>" since PACKAGE_VERSION has
+	# no "-", producing e.g. "0.6.0-1delphix.<ts>".
+	#
+	export PACKAGE_VERSION="${scm_version}"
 	logmust dpkg_buildpackage_default
 }
+
+function update_upstream() {
+	logmust update_upstream_from_git
+}