diff --git a/migrations/20260511085206_[2.0.0]_migrate_location_with_empty_allowed_groups.up.sql b/migrations/20260511085206_[2.0.0]_migrate_location_with_empty_allowed_groups.up.sql
new file mode 100644
index 000000000..761c58737
--- /dev/null
+++ b/migrations/20260511085206_[2.0.0]_migrate_location_with_empty_allowed_groups.up.sql
@@ -0,0 +1,9 @@
+-- In 1.6.x an empty allowed groups list meant all groups have access to location.
+-- Restore that meaning for locations that were migrated without any explicit group assigned.
+UPDATE wireguard_network AS location
+SET allow_all_groups = true
+WHERE NOT EXISTS (
+    SELECT 1
+    FROM wireguard_network_allowed_group AS allowed_group
+    WHERE allowed_group.network_id = location.id
+);