diff --git a/app/controllers/api/migrations.php b/app/controllers/api/migrations.php
index 5bf4813403..9d5e013cdc 100644
--- a/app/controllers/api/migrations.php
+++ b/app/controllers/api/migrations.php
@@ -1,6 +1,5 @@
 <?php
 
-use Ahc\Jwt\JWT;
 use Appwrite\Event\Event;
 use Appwrite\Event\Migration;
 use Appwrite\Extend\Exception;
@@ -719,17 +718,7 @@ Http::get('/v1/migrations/appwrite/report')
     ->inject('user')
     ->action(function (array $resources, string $endpoint, string $projectID, string $key, Response $response) {
 
-        $consoleApiKey = '';
-        $openSslKey = System::getEnv('_APP_OPENSSL_KEY_V1');
-        if (!empty($openSslKey)) {
-            $jwt = new JWT($openSslKey, 'HS256', 86400, 0);
-            $consoleApiKey = API_KEY_DYNAMIC . '_' . $jwt->encode([
-                'projectId' => 'console',
-                'scopes' => ['platforms.read', 'keys.read'],
-            ]);
-        }
-
-        $appwrite = new Appwrite($projectID, $endpoint, $key, consoleApiKey: $consoleApiKey, sourceProjectId: $projectID);
+        $appwrite = new Appwrite($projectID, $endpoint, $key);
 
         try {
             $report = $appwrite->report($resources);
diff --git a/src/Appwrite/Platform/Workers/Migrations.php b/src/Appwrite/Platform/Workers/Migrations.php
index 94fde774e2..3c5eec722c 100644
--- a/src/Appwrite/Platform/Workers/Migrations.php
+++ b/src/Appwrite/Platform/Workers/Migrations.php
@@ -385,7 +385,13 @@ class Migrations extends Action
                 $credentials['projectId'] = $credentials['projectId'] ?? $project->getId();
                 $credentials['apiKey'] = $credentials['apiKey'] ?? $tempAPIKey;
                 $credentials['endpoint'] = $credentials['endpoint'] ?? $endpoint;
-                $credentials['consoleApiKey'] = $credentials['consoleApiKey'] ?? $tempConsoleAPIKey;
+
+                // Only set consoleApiKey for same-instance migrations to avoid
+                // leaking a locally-signed JWT to untrusted remote servers
+                if (($credentials['endpoint'] ?? '') === $endpoint) {
+                    $credentials['consoleApiKey'] = $tempConsoleAPIKey;
+                    $credentials['sourceProjectId'] = $credentials['projectId'];
+                }
             }
 
             if ($migration->getAttribute('destination') === DestinationAppwrite::getName()) {