You need to do both. If you only do the latter, then stale accounts which never log in again will never have their passwords upgraded to the more secure hash. H

You need to do both. If you only do the latter, then stale accounts which never log in again will never have their passwords upgraded to the more secure hash. Hashing the hash allows you to replace the md5 hashes immediately, and then you can perform the upgrade if/when the user logs in again.