diff --git a/migrations/db/20250927101545_site-command_fix_ssl_flag_for_existing_le_certs.php b/migrations/db/20250927101545_site-command_fix_ssl_flag_for_existing_le_certs.php
index 99c1bcfd..e8d04efa 100644
--- a/migrations/db/20250927101545_site-command_fix_ssl_flag_for_existing_le_certs.php
+++ b/migrations/db/20250927101545_site-command_fix_ssl_flag_for_existing_le_certs.php
@@ -51,7 +51,8 @@ public function up() {
 			}
 
 			if ( $crt_exists && $key_exists && $chain_exists ) {
-				if ( empty( $db_ssl ) || $db_ssl !== 'le' ) {
+				// Only repair a never-set flag (NULL/''); '0' is an explicit `--ssl=off`, other values are explicit SSL types.
+				if ( null === $db_ssl || '' === $db_ssl ) {
 					// Check if the cert is a valid Let's Encrypt cert using CertificateParser
 					try {
 						$crt_pem = file_get_contents( $crt );