diff --git a/backend/src/db/migrations/20250824192801_backfill-secret-read-compat-flag.ts b/backend/src/db/migrations/20250824192801_backfill-secret-read-compat-flag.ts
index 7a629ca52..bb9e3ac9a 100644
--- a/backend/src/db/migrations/20250824192801_backfill-secret-read-compat-flag.ts
+++ b/backend/src/db/migrations/20250824192801_backfill-secret-read-compat-flag.ts
@@ -14,13 +14,16 @@ export async function up(knex: Knex): Promise<void> {
     if (rows.length > 0) {
       for (let i = 0; i < rows.length; i += BATCH_SIZE) {
         const batch = rows.slice(i, i + BATCH_SIZE);
+        const ids = batch.map((row) => row.id);
         // eslint-disable-next-line no-await-in-loop
-        await knex(TableName.SecretApprovalPolicy)
-          .whereIn(
-            "id",
-            batch.map((row) => row.id)
-          )
-          .update({ shouldCheckSecretPermission: true });
+        await knex.raw(
+          `
+          UPDATE ??
+          SET ?? = true
+          WHERE ?? IN (${ids.map(() => "?").join(",")})
+          `,
+          [TableName.SecretApprovalPolicy, "shouldCheckSecretPermission", "id", ids]
+        );
       }
     }
   }