diff --git a/services/web/migrations/20230405190240_oauth_refresh_tokens_index.js b/services/web/migrations/20230405190240_oauth_refresh_tokens_index.js
new file mode 100644
index 0000000000..b66da0c52a
--- /dev/null
+++ b/services/web/migrations/20230405190240_oauth_refresh_tokens_index.js
@@ -0,0 +1,47 @@
+const Helpers = require('./lib/helpers')
+
+exports.tags = ['server-ce', 'server-pro', 'saas']
+
+const OLD_INDEX = {
+  key: { refreshToken: 1 },
+  name: 'refreshToken_1',
+  unique: true,
+}
+const NEW_INDEX = {
+  key: { refreshToken: 1 },
+  name: 'refreshToken_1',
+  unique: true,
+  partialFilterExpression: { refreshToken: { $exists: true } },
+}
+const TMP_INDEX = {
+  key: { refreshToken: 1, dummyField: 1 },
+  name: 'refreshToken_tmp',
+}
+
+exports.migrate = async client => {
+  const { db } = client
+  // Create a temporary index so that the refresh tokens are not left unindexed
+  // while we drop the index and recreate it.
+  await Helpers.addIndexesToCollection(db.oauthAccessTokens, [TMP_INDEX])
+
+  // Drop and recreate the index with different options
+  await Helpers.dropIndexesFromCollection(db.oauthAccessTokens, [OLD_INDEX])
+  await Helpers.addIndexesToCollection(db.oauthAccessTokens, [NEW_INDEX])
+
+  // Drop the temporary index
+  await Helpers.dropIndexesFromCollection(db.oauthAccessTokens, [TMP_INDEX])
+}
+
+exports.rollback = async client => {
+  const { db } = client
+  // Create a temporary index so that the refresh tokens are not left unindexed
+  // while we drop the index and recreate it.
+  await Helpers.addIndexesToCollection(db.oauthAccessTokens, [TMP_INDEX])
+
+  // Drop and recreate the index with different options
+  await Helpers.dropIndexesFromCollection(db.oauthAccessTokens, [NEW_INDEX])
+  await Helpers.addIndexesToCollection(db.oauthAccessTokens, [OLD_INDEX])
+
+  // Drop the temporary index
+  await Helpers.dropIndexesFromCollection(db.oauthAccessTokens, [TMP_INDEX])
+}