diff --git a/ocaml/idl/datamodel_host.ml b/ocaml/idl/datamodel_host.ml
index b0fb9a6aac..78b68a3572 100644
--- a/ocaml/idl/datamodel_host.ml
+++ b/ocaml/idl/datamodel_host.ml
@@ -1291,6 +1291,15 @@ let create_params =
     ; param_release= dundee_release
     ; param_default= Some (VDateTime Date.epoch)
     }
+  ; {
+      param_type= String
+    ; param_name= "last_update_hash"
+    ; param_doc=
+        "The SHA256 checksum of updateinfo of the most recently applied update \
+         on the host"
+    ; param_release= numbered_release "24.39.0-next"
+    ; param_default= Some (VString "")
+    }
   ]
 
 let create =
diff --git a/ocaml/tests/common/test_common.ml b/ocaml/tests/common/test_common.ml
index 297a68398c..7ac0868c84 100644
--- a/ocaml/tests/common/test_common.ml
+++ b/ocaml/tests/common/test_common.ml
@@ -170,12 +170,13 @@ let make_host ~__context ?(uuid = make_uuid ()) ?(name_label = "host")
     ?(external_auth_service_name = "") ?(external_auth_configuration = [])
     ?(license_params = []) ?(edition = "free") ?(license_server = [])
     ?(local_cache_sr = Ref.null) ?(chipset_info = []) ?(ssl_legacy = false)
-    ?(last_software_update = Date.epoch) () =
+    ?(last_software_update = Date.epoch) ?(last_update_hash = "") () =
   let host =
     Xapi_host.create ~__context ~uuid ~name_label ~name_description ~hostname
       ~address ~external_auth_type ~external_auth_service_name
       ~external_auth_configuration ~license_params ~edition ~license_server
       ~local_cache_sr ~chipset_info ~ssl_legacy ~last_software_update
+      ~last_update_hash
   in
   Db.Host.set_cpu_info ~__context ~self:host ~value:default_cpu_info ;
   host
diff --git a/ocaml/tests/test_host.ml b/ocaml/tests/test_host.ml
index 80e72f4f11..60c735e2af 100644
--- a/ocaml/tests/test_host.ml
+++ b/ocaml/tests/test_host.ml
@@ -23,7 +23,7 @@ let add_host __context name =
        ~external_auth_service_name:"" ~external_auth_configuration:[]
        ~license_params:[] ~edition:"" ~license_server:[]
        ~local_cache_sr:Ref.null ~chipset_info:[] ~ssl_legacy:false
-       ~last_software_update:Xapi_stdext_date.Date.epoch
+       ~last_software_update:Xapi_stdext_date.Date.epoch ~last_update_hash:""
     )
 
 (* Creates an unlicensed pool with the maximum number of hosts *)
diff --git a/ocaml/xapi/dbsync_slave.ml b/ocaml/xapi/dbsync_slave.ml
index 942d308107..10678562e7 100644
--- a/ocaml/xapi/dbsync_slave.ml
+++ b/ocaml/xapi/dbsync_slave.ml
@@ -59,7 +59,7 @@ let create_localhost ~__context info =
         ~external_auth_configuration:[] ~license_params:[] ~edition:""
         ~license_server:[("address", "localhost"); ("port", "27000")]
         ~local_cache_sr:Ref.null ~chipset_info:[] ~ssl_legacy:false
-        ~last_software_update:Date.epoch
+        ~last_software_update:Date.epoch ~last_update_hash:""
     in
     ()
 
diff --git a/ocaml/xapi/xapi_host.ml b/ocaml/xapi/xapi_host.ml
index 9f84923fe2..1b22a037b3 100644
--- a/ocaml/xapi/xapi_host.ml
+++ b/ocaml/xapi/xapi_host.ml
@@ -991,7 +991,7 @@ let is_host_alive ~__context ~host =
 let create ~__context ~uuid ~name_label ~name_description:_ ~hostname ~address
     ~external_auth_type ~external_auth_service_name ~external_auth_configuration
     ~license_params ~edition ~license_server ~local_cache_sr ~chipset_info
-    ~ssl_legacy:_ ~last_software_update =
+    ~ssl_legacy:_ ~last_software_update ~last_update_hash =
   (* fail-safe. We already test this on the joining host, but it's racy, so multiple concurrent
      pool-join might succeed. Note: we do it in this order to avoid a problem checking restrictions during
      the initial setup of the database *)
@@ -1053,9 +1053,9 @@ let create ~__context ~uuid ~name_label ~name_description:_ ~hostname ~address
       )
     ~control_domain:Ref.null ~updates_requiring_reboot:[] ~iscsi_iqn:""
     ~multipathing:false ~uefi_certificates:"" ~editions:[] ~pending_guidances:[]
-    ~tls_verification_enabled ~last_software_update ~recommended_guidances:[]
-    ~latest_synced_updates_applied:`unknown ~pending_guidances_recommended:[]
-    ~pending_guidances_full:[] ~last_update_hash:"" ;
+    ~tls_verification_enabled ~last_software_update ~last_update_hash
+    ~recommended_guidances:[] ~latest_synced_updates_applied:`unknown
+    ~pending_guidances_recommended:[] ~pending_guidances_full:[] ;
   (* If the host we're creating is us, make sure its set to live *)
   Db.Host_metrics.set_last_updated ~__context ~self:metrics ~value:(Date.now ()) ;
   Db.Host_metrics.set_live ~__context ~self:metrics ~value:host_is_us ;
diff --git a/ocaml/xapi/xapi_host.mli b/ocaml/xapi/xapi_host.mli
index c303ee6959..bafc47f6de 100644
--- a/ocaml/xapi/xapi_host.mli
+++ b/ocaml/xapi/xapi_host.mli
@@ -129,6 +129,7 @@ val create :
   -> chipset_info:(string * string) list
   -> ssl_legacy:bool
   -> last_software_update:API.datetime
+  -> last_update_hash:string
   -> [`host] Ref.t
 
 val destroy : __context:Context.t -> self:API.ref_host -> unit
diff --git a/ocaml/xapi/xapi_pool.ml b/ocaml/xapi/xapi_pool.ml
index dd4bca70e2..93e03cd15a 100644
--- a/ocaml/xapi/xapi_pool.ml
+++ b/ocaml/xapi/xapi_pool.ml
@@ -968,6 +968,7 @@ let rec create_or_get_host_on_master __context rpc session_id (host_ref, host) :
           ~local_cache_sr ~chipset_info:host.API.host_chipset_info
           ~ssl_legacy:false
           ~last_software_update:host.API.host_last_software_update
+          ~last_update_hash:host.API.host_last_update_hash
       in
       (* Copy other-config into newly created host record: *)
       no_exn