Changing the user and groups so that they're like in the 3.x install seems to have solved that particular issue. (The group name was also referenced in a config file.)
The upgrade still failed with a different error message, and the service won't start, apparently because a cleanup-script is trying to rm a directory. I don't know if I missed the username in some config file or if these are unrelated issues, but either way I'm shelving this until I have time to do a clean reinstall.