diff --git a/migrations/db/20250927101545_site-command_fix_ssl_flag_for_existing_le_certs.php b/migrations/db/20250927101545_site-command_fix_ssl_flag_for_existing_le_certs.php
index 99c1bcfd..4a599357 100644
--- a/migrations/db/20250927101545_site-command_fix_ssl_flag_for_existing_le_certs.php
+++ b/migrations/db/20250927101545_site-command_fix_ssl_flag_for_existing_le_certs.php
@@ -51,7 +51,8 @@ public function up() {
 			}
 
 			if ( $crt_exists && $key_exists && $chain_exists ) {
-				if ( empty( $db_ssl ) || $db_ssl !== 'le' ) {
+				// Only repair sites with an unset SSL flag; never override an explicit custom/self/inherit (or le) choice.
+				if ( empty( $db_ssl ) ) {
 					// Check if the cert is a valid Let's Encrypt cert using CertificateParser
 					try {
 						$crt_pem = file_get_contents( $crt );