Hi @ifro,
The OpenZeppelin CLI supported calling a function as part of an upgrade.
Please note: We’ve decided it’s best to focus our upgradeability efforts on the Upgrades Plugins exclusively, and have halted development on the OpenZeppelin CLI. See: Building for interoperability: why we’re focusing on Upgrades Plugins
The OpenZeppelin Upgrades Plugins don’t have this functionality currently, hence we need to call the function in a separate transaction, ensuring it is only called once and is protected so only we can call it.