diff --git a/MANIFEST.in b/MANIFEST.in
--- a/MANIFEST.in
+++ b/MANIFEST.in
@@ -1,5 +1,7 @@
 include Makefile
+include README.md
 include requirements*.txt
 include version.txt
-include README.md
+recursive-include sql *
+recursive-include swh/provenance/sql *
 recursive-include swh py.typed
diff --git a/sql/upgrades/003.sql b/sql/upgrades/003.sql
new file mode 100644
--- /dev/null
+++ b/sql/upgrades/003.sql
@@ -0,0 +1,13 @@
+-- SWH DB schema upgrade
+-- from_version: 2
+-- to_version: 3
+-- description: keep unique indices for origins and locations in a hash column
+
+
+insert into dbversion(version, release, description)
+    values(3, now(), 'Work In Progress');
+
+drop index if exists location_path_key;
+create unique index on location(digest(path::bytea, 'sha1'::text));
+
+drop index if exists origin_url_key;
diff --git a/swh/provenance/sql/10-superuser-init.sql b/swh/provenance/sql/10-superuser-init.sql
new file mode 100644
--- /dev/null
+++ b/swh/provenance/sql/10-superuser-init.sql
@@ -0,0 +1,2 @@
+-- require being Postgres super user
+create extension if not exists pgcrypto;
diff --git a/swh/provenance/sql/30-schema.sql b/swh/provenance/sql/30-schema.sql
--- a/swh/provenance/sql/30-schema.sql
+++ b/swh/provenance/sql/30-schema.sql
@@ -16,7 +16,7 @@
 
 -- latest schema version
 insert into dbversion(version, release, description)
-    values(2, now(), 'Work In Progress');
+    values(3, now(), 'Work In Progress');
 
 -- a Git object ID, i.e., a Git-style salted SHA1 checksum
 create domain sha1_git as bytea check (length(value) = 20);
@@ -70,7 +70,7 @@
 create table location
 (
     id      bigserial primary key,          -- internal identifier of the location
-    path    unix_path unique not null       -- path to the location
+    path    unix_path                       -- path to the location
 );
 comment on column location.id is 'Location internal identifier';
 comment on column location.path is 'Path to the location';
@@ -79,7 +79,7 @@
 (
     id      bigserial primary key,          -- internal identifier of the origin
     sha1    sha1_git unique not null,       -- intrinsic identifier of the origin
-    url     text unique not null            -- url of the origin
+    url     text                            -- url of the origin
 );
 comment on column origin.id is 'Origin internal identifier';
 comment on column origin.sha1 is 'Origin intrinsic identifier';
diff --git a/swh/provenance/sql/60-indexes.sql b/swh/provenance/sql/60-indexes.sql
--- a/swh/provenance/sql/60-indexes.sql
+++ b/swh/provenance/sql/60-indexes.sql
@@ -13,6 +13,7 @@
 create unique index on content_in_directory(content);
 \endif
 
+create unique index on location(digest(path, 'sha1'));
 
 alter table revision_in_origin add primary key (revision, origin);
 alter table revision_before_revision add primary key (prev, next);
diff --git a/swh/provenance/tests/conftest.py b/swh/provenance/tests/conftest.py
--- a/swh/provenance/tests/conftest.py
+++ b/swh/provenance/tests/conftest.py
@@ -37,8 +37,9 @@
     postgresql: psycopg2.extensions.connection,
 ) -> Dict[str, str]:
     """return a working and initialized provenance db"""
-    from swh.core.cli.db import populate_database_for_package
+    from swh.core.cli.db import init_admin_extensions, populate_database_for_package
 
+    init_admin_extensions("swh.provenance", postgresql.dsn)
     populate_database_for_package(
         "swh.provenance", postgresql.dsn, flavor=request.param
     )
@@ -103,8 +104,9 @@
 ) -> Generator[ProvenanceInterface, None, None]:
     """Return a working and initialized ProvenanceInterface object"""
 
-    from swh.core.cli.db import populate_database_for_package
+    from swh.core.cli.db import init_admin_extensions, populate_database_for_package
 
+    init_admin_extensions("swh.provenance", provenance_postgresql.dsn)
     populate_database_for_package(
         "swh.provenance", provenance_postgresql.dsn, flavor="with-path"
     )
diff --git a/swh/provenance/tests/test_cli.py b/swh/provenance/tests/test_cli.py
--- a/swh/provenance/tests/test_cli.py
+++ b/swh/provenance/tests/test_cli.py
@@ -12,6 +12,7 @@
 
 from swh.core.cli import swh as swhmain
 import swh.core.cli.db  # noqa ; ensure cli is loaded
+from swh.core.cli.db import init_admin_extensions
 from swh.core.db import BaseDb
 import swh.provenance.cli  # noqa ; ensure cli is loaded
 
@@ -96,7 +97,9 @@
 
 def test_cli_init_db_default_flavor(postgresql: psycopg2.extensions.connection) -> None:
     "Test that 'swh db init provenance' defaults to a with-path flavored DB"
+
     dbname = postgresql.dsn
+    init_admin_extensions("swh.provenance", dbname)
     result = CliRunner().invoke(swhmain, ["db", "init", "-d", dbname, "provenance"])
     assert result.exit_code == 0, result.output