diff --git a/playbooks/zuul/upgrade-review.yaml b/playbooks/zuul/upgrade-review.yaml
index 888c2ab34a..c7d69ae24a 100644
--- a/playbooks/zuul/upgrade-review.yaml
+++ b/playbooks/zuul/upgrade-review.yaml
@@ -15,8 +15,38 @@
         cmd: docker-compose down
         chdir: /etc/gerrit-compose/
 
+    - name: Backup config files
+      block:
+        - name: Find .config files
+          find:
+            paths: /home/gerrit2/review_site/etc
+            patterns: '*.config'
+          register: _config_files
+
+        - name: 'Backup config file'
+          copy:
+            src: '{{ item }}'
+            dest: '{{ item }}.pre-upgrade'
+            remote_src: true
+          loop: "{{ _config_files.files | map(attribute='path') | list }}"
+
 - name: Perform gerrit upgrade
   import_playbook: ../service-review.yaml
   vars:
     gerrit_container_image: docker.io/opendevorg/gerrit:3.3
     gerrit_run_init: true
+
+- hosts: "review:!disabled"
+  name: "Post upgrade config check"
+  tasks:
+    - name: Diff config files
+      shell: |
+          diff -u {{ item }}.pre-upgrade {{ item }} | tee {{ item }}.diff
+      loop: "{{ _config_files.files | map(attribute='path') | list }}"
+      register: _diff_output
+
+    - name: Check diffs
+      fail:
+        msg: 'Difference detected in file {{ item.item }} '
+      when: item.rc != 0
+      loop: '{{ _diff_output.results }}'
diff --git a/zuul.d/system-config-run.yaml b/zuul.d/system-config-run.yaml
index 520328a236..90ee1568fb 100644
--- a/zuul.d/system-config-run.yaml
+++ b/zuul.d/system-config-run.yaml
@@ -886,6 +886,7 @@
       - roles/bazelisk-build/
       - testinfra/test_gerrit.py
       - docker/gerrit/
+      - playbooks/zuul/upgrade-review.yaml
 
 - job:
     name: system-config-run-review-3.2