Object-oriented databases allow objects that are manipulated by programs to be stored reliably so that they can be used again later and shared with other programs. Since objects in the OODB may live a long time, there may be a need to upgrade them: to change their code and storage representation. This paper describes a technique for upgrading objects in an OODB. The approach preserves the database state by transforming objects to their new classes while retaining their state and their identity. The approach is efficient: we do not interrupt application execution to run an upgrade, but instead run the upgrade incrementally, one transform at a time. Objects are transformed lazily, but just in time; applications never observe non-upgraded objects. Laziness can sometimes lead to problems for the code that transforms objects, however; e.g., a transform might observe broken invariants or interfaces unknown at the time it was written. We define precisely when these problems arise, and we also provide mechanisms for avoiding them. Ours is the first work to provide a full analysis of these problems and to allow safe lazy upgrades even when problems arise. We have implemented our approach on the Thor OODB and we present performance results that show that the overhead of our infrastructure is low.