diff --git a/backend/src/db/migrations/20250418003930_ssh-nullable-ca-defaults.ts b/backend/src/db/migrations/20250418003930_ssh-nullable-ca-defaults.ts
index 3bc64d86b..0711f8c18 100644
--- a/backend/src/db/migrations/20250418003930_ssh-nullable-ca-defaults.ts
+++ b/backend/src/db/migrations/20250418003930_ssh-nullable-ca-defaults.ts
@@ -7,19 +7,25 @@ export async function up(knex: Knex): Promise<void> {
   const hasDefaultHostCaCol = await knex.schema.hasColumn(TableName.ProjectSshConfig, "defaultHostSshCaId");
 
   if (hasDefaultUserCaCol && hasDefaultHostCaCol) {
-    await knex.schema.alterTable(TableName.ProjectSshConfig, (t) => {
-      t.dropForeign(["defaultUserSshCaId"]);
-      t.dropForeign(["defaultHostSshCaId"]);
-    });
-
-    await knex.schema.alterTable(TableName.ProjectSshConfig, (t) => {
-      // allow nullable (does not wipe existing values)
-      t.uuid("defaultUserSshCaId").nullable().alter();
-      t.uuid("defaultHostSshCaId").nullable().alter();
-
-      // re-add with SET NULL behavior (previously CASCADE)
-      t.foreign("defaultUserSshCaId").references("id").inTable(TableName.SshCertificateAuthority).onDelete("SET NULL");
-      t.foreign("defaultHostSshCaId").references("id").inTable(TableName.SshCertificateAuthority).onDelete("SET NULL");
+    await knex.transaction(async (trx) => {
+      await trx.schema.alterTable(TableName.ProjectSshConfig, (t) => {
+        t.dropForeign(["defaultUserSshCaId"]);
+        t.dropForeign(["defaultHostSshCaId"]);
+      });
+      await trx.schema.alterTable(TableName.ProjectSshConfig, (t) => {
+        // allow nullable (does not wipe existing values)
+        t.uuid("defaultUserSshCaId").nullable().alter();
+        t.uuid("defaultHostSshCaId").nullable().alter();
+        // re-add with SET NULL behavior (previously CASCADE)
+        t.foreign("defaultUserSshCaId")
+          .references("id")
+          .inTable(TableName.SshCertificateAuthority)
+          .onDelete("SET NULL");
+        t.foreign("defaultHostSshCaId")
+          .references("id")
+          .inTable(TableName.SshCertificateAuthority)
+          .onDelete("SET NULL");
+      });
     });
   }
 
diff --git a/docs/cli/commands/ssh.mdx b/docs/cli/commands/ssh.mdx
index 534c55b66..d99a69dda 100644
--- a/docs/cli/commands/ssh.mdx
+++ b/docs/cli/commands/ssh.mdx
@@ -26,12 +26,12 @@ This command enables you to obtain SSH credentials used to access a remote host.
         The login user for the SSH connection. If not provided, you will be prompted to select from available login users.
     </Accordion>
     <Accordion title="--writeHostCaToFile">
-        Whether to write the Host CA public key to ~/.ssh/known_hosts if it doesn't already exist.
+        Whether to write the Host CA public key to `~/.ssh/known_hosts` if it doesn't already exist.
 
         Default value: `true`
     </Accordion>
     <Accordion title="--outFilePath">
-        The path to write the SSH credentials to such as ~/.ssh, ./some_folder, ./some_folder/id_rsa-cert.pub. If not provided, the credentials will be added to the SSH agent and used to establish an interactive SSH connection.
+        The path to write the SSH credentials to such as `~/.ssh`, `./some_folder`, `./some_folder/id_rsa-cert.pub`. If not provided, the credentials will be added to the SSH agent and used to establish an interactive SSH connection.
     </Accordion>
     <Accordion title="--token">
         An authenticated token to use to authenticate with Infisical.
diff --git a/frontend/src/pages/ssh/SettingsPage/components/ProjectSshTab/components/ProjectSshConfigCasSection.tsx b/frontend/src/pages/ssh/SettingsPage/components/ProjectSshTab/components/ProjectSshConfigCasSection.tsx
index 36a6df348..503717326 100644
--- a/frontend/src/pages/ssh/SettingsPage/components/ProjectSshTab/components/ProjectSshConfigCasSection.tsx
+++ b/frontend/src/pages/ssh/SettingsPage/components/ProjectSshTab/components/ProjectSshConfigCasSection.tsx
@@ -15,8 +15,8 @@ import {
 
 const schema = z
   .object({
-    defaultUserSshCaId: z.string().optional(),
-    defaultHostSshCaId: z.string().optional()
+    defaultUserSshCaId: z.string(),
+    defaultHostSshCaId: z.string()
   })
   .required();
 
@@ -40,8 +40,8 @@ export const ProjectSshConfigCasSection = () => {
   useEffect(() => {
     if (sshConfig) {
       reset({
-        defaultUserSshCaId: sshConfig.defaultUserSshCaId || undefined,
-        defaultHostSshCaId: sshConfig.defaultHostSshCaId || undefined
+        defaultUserSshCaId: sshConfig.defaultUserSshCaId || "",
+        defaultHostSshCaId: sshConfig.defaultHostSshCaId || ""
       });
     }
   }, [sshConfig]);