diff --git a/src/confd/share/migrate/1.7/20-keystore-cleartext-key-rename.sh b/src/confd/share/migrate/1.7/20-keystore-cleartext-key-rename.sh
index b55b42d79..7bc9a4ba0 100755
--- a/src/confd/share/migrate/1.7/20-keystore-cleartext-key-rename.sh
+++ b/src/confd/share/migrate/1.7/20-keystore-cleartext-key-rename.sh
@@ -1,5 +1,5 @@
 #!/bin/sh
-# Rename cleartext-key to symmetric-key
+# Rename cleartext-key to symmetric-key and wrap in key-type container
 
 file=$1
 temp=${file}.tmp
@@ -8,10 +8,12 @@ jq '
 if .["ietf-keystore:keystore"]?."symmetric-keys"?."symmetric-key" then
   .["ietf-keystore:keystore"]."symmetric-keys"."symmetric-key" |= map(
     if ."infix-keystore:cleartext-key" then
-      # Rename cleartext-key to symmetric-key
+      # Rename cleartext-key to symmetric-key and wrap in key-type
       ."infix-keystore:cleartext-key" as $key_value |
       del(."infix-keystore:cleartext-key") | . + {
-        "infix-keystore:symmetric-key": $key_value
+        "key-type": {
+          "infix-keystore:symmetric-key": $key_value
+        }
       }
     else
       .