How to get a user to call SearchService.search from PluginUpgradeTask?

We are in the process of writing a com.atlassian.sal.api.upgrade.PluginUpgradeTask that needs to migrate issue properties to a new data format (because of this issue). Instead of blindly processing all issues, I am trying to run a JQL query that gets us only the issues that actually have the property defined.

For most operations (search, parseQuery) the SearchService requires an ApplicationUser, however, we don’t have one in the context of the PluginUpgradeTask.

Does anyone know how to work around this or what kind of secret Jira Server magic we can use to successfully run the JQL search?

It seems calling parseQuery with null as searcher (ApplicationUser) seems to be fine and instead of calling search, using searchOverrideSecurity with a null searcher works.

Regarding updating properties it seems that IssuePropertyService.getProperty and IssuePropertyService.validateSetProperty take a param of EntityPropertyOptions that can be configured to skip security checks.