It seems that if the S7 is encrypted, the data partition needs to be reformatted for the upgrade to work.
I was able to run through the steps of “Manually upgrading your herolte to Q”, but at the end - after rebooting and decrypting the phone - could no longer log into it.
A factory reset was required (together with reinstalling all apps etc.) to get the phone back to working conditions.
It was suggested in this thread that reformatting the data partition might even be a requirement for the upgrade.
If it is (for all or only for encrypted devices) this should be mentioned in the upgrade guide.