diff --git a/backend/src/db/migrations/20241028134337_kms-with-hsm.ts b/backend/src/db/migrations/20241028134337_kms-root-cfg-hsm.ts
similarity index 57%
rename from backend/src/db/migrations/20241028134337_kms-with-hsm.ts
rename to backend/src/db/migrations/20241028134337_kms-root-cfg-hsm.ts
index 86fc556d6..a586f94b8 100644
--- a/backend/src/db/migrations/20241028134337_kms-with-hsm.ts
+++ b/backend/src/db/migrations/20241028134337_kms-root-cfg-hsm.ts
@@ -3,21 +3,21 @@ import { Knex } from "knex";
 import { TableName } from "../schemas";
 
 export async function up(knex: Knex): Promise<void> {
-  const hasIsEncryptedByHsmCol = await knex.schema.hasColumn(TableName.KmsServerRootConfig, "isEncryptedByHsm");
+  const hasEncryptionStrategy = await knex.schema.hasColumn(TableName.KmsServerRootConfig, "encryptionStrategy");
   const hasTimestampsCol = await knex.schema.hasColumn(TableName.KmsServerRootConfig, "createdAt");
 
   await knex.schema.alterTable(TableName.KmsServerRootConfig, (t) => {
-    if (!hasIsEncryptedByHsmCol) t.boolean("isEncryptedByHsm").defaultTo(false).notNullable();
-    if (!hasTimestampsCol) t.timestamps(true, true);
+    if (!hasEncryptionStrategy) t.string("encryptionStrategy").defaultTo("BASIC");
+    if (!hasTimestampsCol) t.timestamps(true, true, true);
   });
 }
 
 export async function down(knex: Knex): Promise<void> {
-  const hasIsEncryptedByHsmCol = await knex.schema.hasColumn(TableName.KmsServerRootConfig, "isEncryptedByHsm");
+  const hasEncryptionStrategy = await knex.schema.hasColumn(TableName.KmsServerRootConfig, "encryptionStrategy");
   const hasTimestampsCol = await knex.schema.hasColumn(TableName.KmsServerRootConfig, "createdAt");
 
   await knex.schema.alterTable(TableName.KmsServerRootConfig, (t) => {
-    if (hasIsEncryptedByHsmCol) t.dropColumn("isEncryptedByHsm");
+    if (hasEncryptionStrategy) t.dropColumn("encryptionStrategy");
     if (hasTimestampsCol) t.dropTimestamps(true);
   });
 }