diff --git a/backend/src/db/migrations/20250109104508_directory-config-to-kms.ts b/backend/src/db/migrations/20250109104508_directory-config-to-kms.ts
index 4addc2d81..9771e57c5 100644
--- a/backend/src/db/migrations/20250109104508_directory-config-to-kms.ts
+++ b/backend/src/db/migrations/20250109104508_directory-config-to-kms.ts
@@ -296,7 +296,7 @@ const reencryptLdapConfig = async (knex: Knex) => {
     await knex.schema.alterTable(TableName.LdapConfig, (t) => {
       if (!hasEncryptedLdapBindPassColumn) t.binary("encryptedLdapBindPass").notNullable().alter();
       if (!hasEncryptedLdapBindDNColum) t.binary("encryptedLdapBindDN").notNullable().alter();
-      if (!hasEncryptedCertificateColumn) t.binary("encryptedLdapCaCertificate").notNullable().alter();
+      if (!hasEncryptedCertificateColumn) t.binary("encryptedLdapCaCertificate");
     });
   }
 };
diff --git a/backend/src/db/schemas/ldap-configs.ts b/backend/src/db/schemas/ldap-configs.ts
index 94bf0dd03..778e7be6e 100644
--- a/backend/src/db/schemas/ldap-configs.ts
+++ b/backend/src/db/schemas/ldap-configs.ts
@@ -32,7 +32,7 @@ export const LdapConfigsSchema = z.object({
   uniqueUserAttribute: z.string().default(""),
   encryptedLdapBindDN: zodBuffer,
   encryptedLdapBindPass: zodBuffer,
-  encryptedLdapCaCertificate: zodBuffer
+  encryptedLdapCaCertificate: zodBuffer.nullable().optional()
 });
 
 export type TLdapConfigs = z.infer<typeof LdapConfigsSchema>;