diff --git a/src/seedpass/core/vault.py b/src/seedpass/core/vault.py
index 167280a..11433ac 100644
--- a/src/seedpass/core/vault.py
+++ b/src/seedpass/core/vault.py
@@ -99,6 +99,9 @@ class Vault:
             )
         schema_migrated = version < LATEST_VERSION
         data = apply_migrations(data)
+        if schema_migrated:
+            self.encryption_manager.save_json_data(data, self.index_file)
+            self.encryption_manager.update_checksum(self.index_file)
         self.migrated_from_legacy = (
             self.migrated_from_legacy or migration_performed or schema_migrated
         )
diff --git a/src/tests/test_migrations.py b/src/tests/test_migrations.py
index 7f361ad..aaae54c 100644
--- a/src/tests/test_migrations.py
+++ b/src/tests/test_migrations.py
@@ -78,3 +78,29 @@ def test_error_on_future_version(tmp_path: Path):
     enc_mgr.save_json_data(future)
     with pytest.raises(ValueError):
         vault.load_index()
+
+
+def test_schema_migration_persisted_once(tmp_path: Path):
+    enc_mgr, vault = setup(tmp_path)
+    legacy = {
+        "schema_version": 3,
+        "entries": {
+            "0": {
+                "label": "a",
+                "length": 8,
+                "type": "password",
+                "notes": "",
+                "custom_fields": [],
+                "origin": "",
+            }
+        },
+    }
+    enc_mgr.save_json_data(legacy)
+    data, migrated = vault.load_index(return_migration_flag=True)
+    assert migrated is True
+    assert data["schema_version"] == LATEST_VERSION
+    assert data["entries"]["0"]["tags"] == []
+
+    data_again, migrated_again = vault.load_index(return_migration_flag=True)
+    assert migrated_again is False
+    assert data_again == data