I believe the postStart lifecycle hook might do what you want; one will just need to be cautious because it is per Pod creation, which yes, will happen on update, but will also happen if a Pod is terminated for non-upgrade reasons

If you need to keep track of whether a Pod has been upgraded (and thus does not need action if it is just restarted), you can have the Pod add either a label or an annotation to itself using the service account credentials under which it is running.