diff --git a/apps/emqx_authn/src/emqx_authn.app.src b/apps/emqx_authn/src/emqx_authn.app.src
index d32b74e49..09ccfb358 100644
--- a/apps/emqx_authn/src/emqx_authn.app.src
+++ b/apps/emqx_authn/src/emqx_authn.app.src
@@ -1,7 +1,7 @@
 %% -*- mode: erlang -*-
 {application, emqx_authn, [
     {description, "EMQX Authentication"},
-    {vsn, "0.1.0"},
+    {vsn, "0.1.1"},
     {modules, []},
     {registered, [emqx_authn_sup, emqx_authn_registry]},
     {applications, [kernel, stdlib, emqx_resource, ehttpc, epgsql, mysql, jose]},
diff --git a/apps/emqx_authn/src/emqx_authn.appup.src b/apps/emqx_authn/src/emqx_authn.appup.src
new file mode 100644
index 000000000..54b81ffba
--- /dev/null
+++ b/apps/emqx_authn/src/emqx_authn.appup.src
@@ -0,0 +1,8 @@
+%% Unless you know what you are doing, DO NOT edit manually!!
+{VSN,
+  [{"0.1.0",
+    [{load_module,emqx_authz_utils,brutal_purge,soft_purge,[]}]},
+   {<<".*">>,[]}],
+  [{"0.1.0",
+    [{load_module,emqx_authz_utils,brutal_purge,soft_purge,[]}]},
+   {<<".*">>,[]}]}.
diff --git a/apps/emqx_authn/src/emqx_authn_utils.erl b/apps/emqx_authn/src/emqx_authn_utils.erl
index 232cf5ac1..1bd65c7c8 100644
--- a/apps/emqx_authn/src/emqx_authn_utils.erl
+++ b/apps/emqx_authn/src/emqx_authn_utils.erl
@@ -50,22 +50,24 @@
 %%------------------------------------------------------------------------------
 
 create_resource(ResourceId, Module, Config) ->
-    {ok, _Data} = emqx_resource:create_local(
+    Result = emqx_resource:create_local(
         ResourceId,
         ?RESOURCE_GROUP,
         Module,
         Config,
-        #{}
-    ).
+        #{start_after_created => false}
+    ),
+    start_resource_if_enabled(Result, ResourceId, Config).
 
 update_resource(Module, Config, ResourceId) ->
     Opts = #{start_after_created => false},
     Result = emqx_resource:recreate_local(ResourceId, Module, Config, Opts),
-    _ =
-        case Config of
-            #{enable := true} -> emqx_resource:start(ResourceId);
-            #{enable := false} -> ok
-        end,
+    start_resource_if_enabled(Result, ResourceId, Config).
+
+start_resource_if_enabled({ok, _} = Result, ResourceId, #{enable := true}) ->
+    _ = emqx_resource:start(ResourceId),
+    Result;
+start_resource_if_enabled(Result, _ResourceId, _Config) ->
     Result.
 
 check_password_from_selected_map(_Algorithm, _Selected, undefined) ->
diff --git a/apps/emqx_authz/src/emqx_authz.app.src b/apps/emqx_authz/src/emqx_authz.app.src
index a8e781df9..d1d976959 100644
--- a/apps/emqx_authz/src/emqx_authz.app.src
+++ b/apps/emqx_authz/src/emqx_authz.app.src
@@ -1,7 +1,7 @@
 %% -*- mode: erlang -*-
 {application, emqx_authz, [
     {description, "An OTP application"},
-    {vsn, "0.1.1"},
+    {vsn, "0.1.2"},
     {registered, []},
     {mod, {emqx_authz_app, []}},
     {applications, [
diff --git a/apps/emqx_authz/src/emqx_authz.appup.src b/apps/emqx_authz/src/emqx_authz.appup.src
new file mode 100644
index 000000000..897c78c59
--- /dev/null
+++ b/apps/emqx_authz/src/emqx_authz.appup.src
@@ -0,0 +1,8 @@
+%% Unless you know what you are doing, DO NOT edit manually!!
+{VSN,
+  [{"0.1.1",
+    [{load_module,emqx_authn_utils,brutal_purge,soft_purge,[]}]},
+   {<<".*">>,[]}],
+  [{"0.1.1",
+    [{load_module,emqx_authn_utils,brutal_purge,soft_purge,[]}]},
+   {<<".*">>,[]}]}.
diff --git a/apps/emqx_authz/src/emqx_authz_utils.erl b/apps/emqx_authz/src/emqx_authz_utils.erl
index a24df28cd..2e547941a 100644
--- a/apps/emqx_authz/src/emqx_authz_utils.erl
+++ b/apps/emqx_authz/src/emqx_authz_utils.erl
@@ -43,33 +43,35 @@ create_resource(Module, Config) ->
     create_resource(ResourceId, Module, Config).
 
 create_resource(ResourceId, Module, Config) ->
-    {ok, _Data} = emqx_resource:create_local(
+    Result = emqx_resource:create_local(
         ResourceId,
         ?RESOURCE_GROUP,
         Module,
         Config,
-        #{}
-    ).
+        #{start_after_created => false}
+    ),
+    start_resource_if_enabled(Result, ResourceId, Config).
 
-update_resource(Module, #{annotations := #{id := ResourceId}} = Source) ->
+update_resource(Module, #{annotations := #{id := ResourceId}} = Config) ->
     Result =
         case
             emqx_resource:recreate_local(
                 ResourceId,
                 Module,
-                Source
+                Config,
+                #{start_after_created => false}
             )
         of
             {ok, _} -> {ok, ResourceId};
             {error, Reason} -> {error, Reason}
         end,
-    case Source of
-        #{enable := true} ->
-            Result;
-        #{enable := false} ->
-            ok = emqx_resource:stop(ResourceId),
-            Result
-    end.
+    start_resource_if_enabled(Result, ResourceId, Config).
+
+start_resource_if_enabled({ok, _} = Result, ResourceId, #{enable := true}) ->
+    _ = emqx_resource:start(ResourceId),
+    Result;
+start_resource_if_enabled(Result, _ResourceId, _Config) ->
+    Result.
 
 cleanup_resources() ->
     lists:foreach(