jsonapi.install                                    | 10 +++++
 .../drupal-8.jsonapi-jsonapi_update_8001.php       | 49 ++++++++++++++++++++++
 .../Functional/Update/ReadOnlyModeUpdateTest.php   | 48 +++++++++++++++++++++
 3 files changed, 107 insertions(+)

diff --git a/jsonapi.install b/jsonapi.install
index 73fabd9..de1ea4e 100644
--- a/jsonapi.install
+++ b/jsonapi.install
@@ -53,3 +53,13 @@ function jsonapi_requirements($phase) {
   }
   return $requirements;
 }
+
+/**
+ * Enable BC: default the new read-only mode to "off" on existing sites.
+ */
+function jsonapi_update_8001() {
+  $config_factory = \Drupal::configFactory();
+  $jsonapi_settings = $config_factory->getEditable('jsonapi.settings');
+  $jsonapi_settings->set('read_only', FALSE)
+    ->save(TRUE);
+}
diff --git a/tests/fixtures/update/drupal-8.jsonapi-jsonapi_update_8001.php b/tests/fixtures/update/drupal-8.jsonapi-jsonapi_update_8001.php
new file mode 100644
index 0000000..6a40bf2
--- /dev/null
+++ b/tests/fixtures/update/drupal-8.jsonapi-jsonapi_update_8001.php
@@ -0,0 +1,49 @@
+<?php
+
+/**
+ * @file
+ * Contains database additions for testing jsonapi_update_8001()'s update path.
+ *
+ * @depends core/modules/system/tests/fixtures/update/drupal-8.bare.standard.php.gz
+ */
+
+use Drupal\Core\Database\Database;
+
+$connection = Database::getConnection();
+
+// Set the schema version.
+$connection->insert('key_value')
+  ->fields([
+    'collection',
+    'name',
+    'value',
+  ])
+  ->values([
+    'collection' => 'system.schema',
+    'name' => 'serialization',
+    'value' => 'i:8401;',
+  ])
+  ->values([
+    'collection' => 'system.schema',
+    'name' => 'jsonapi',
+    'value' => 'i:8000;',
+  ])
+  ->execute();
+
+// Update core.extension.
+$extensions = $connection->select('config')
+  ->fields('config', ['data'])
+  ->condition('collection', '')
+  ->condition('name', 'core.extension')
+  ->execute()
+  ->fetchField();
+$extensions = unserialize($extensions);
+$extensions['module']['serialization'] = 0;
+$extensions['module']['jsonapi'] = 0;
+$connection->update('config')
+  ->fields([
+    'data' => serialize($extensions),
+  ])
+  ->condition('collection', '')
+  ->condition('name', 'core.extension')
+  ->execute();
diff --git a/tests/src/Functional/Update/ReadOnlyModeUpdateTest.php b/tests/src/Functional/Update/ReadOnlyModeUpdateTest.php
new file mode 100644
index 0000000..7c6b26a
--- /dev/null
+++ b/tests/src/Functional/Update/ReadOnlyModeUpdateTest.php
@@ -0,0 +1,48 @@
+<?php
+
+namespace Drupal\jsonapi\Tests\Functional\Update;
+
+use Drupal\FunctionalTests\Update\UpdatePathTestBase;
+
+/**
+ * Tests that existing sites have the new read-only mode to "off".
+ *
+ * @see jsonapi_update_8001()
+ * @see https://www.drupal.org/project/jsonapi/issues/3039568
+ *
+ * @group jsonapi
+ */
+class ReadOnlyModeUpdateTest extends UpdatePathTestBase {
+
+  /**
+   * {@inheritdoc}
+   */
+  protected static $modules = ['jsonapi'];
+
+  /**
+   * {@inheritdoc}
+   */
+  public function setDatabaseDumpFiles() {
+    $this->databaseDumpFiles = [
+      DRUPAL_ROOT . '/core/modules/system/tests/fixtures/update/drupal-8.bare.standard.php.gz',
+      __DIR__ . '/../../../fixtures/update/drupal-8.jsonapi-jsonapi_update_8001.php',
+    ];
+  }
+
+  /**
+   * Tests jsonapi_update_8001().
+   */
+  public function testBcReadOnlyModeSettingAdded() {
+    // Make sure we have the expected values before the update.
+    $jsonapi_settings = $this->config('jsonapi.settings');
+    $this->assertFalse(array_key_exists('read_only', $jsonapi_settings->getRawData()));
+
+    $this->runUpdates();
+
+    // Make sure we have the expected values after the update.
+    $jsonapi_settings = $this->config('jsonapi.settings');
+    $this->assertTrue(array_key_exists('read_only', $jsonapi_settings->getRawData()));
+    $this->assertFalse($jsonapi_settings->get('read_only'));
+  }
+
+}