diff --git a/README.md b/README.md
index 627d81f..16818a7 100644
--- a/README.md
+++ b/README.md
@@ -40,6 +40,7 @@ sudo systemctl restart hecate.service
 The installer is idempotent:
 - Re-runs safely on every update
 - Preserves existing `/etc/hecate/hecate.yaml`
+- Automatically migrates legacy defaults (for example `default_budget_seconds: 300` and `runtime_safety_factor: 1.10`)
 - Ensures required dependencies are installed (`kubectl`, `nut-*`, `ssh`, `go`, etc.)
 - Installs/refreshes systemd units and enables boot-time self-update
 - Applies declarative NUT + udev UPS configuration by default (can be tuned via env vars)
diff --git a/scripts/install.sh b/scripts/install.sh
index 4d955f9..cec8633 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -71,6 +71,41 @@ read_hecate_role() {
   echo "${role}"
 }
 
+migrate_hecate_config() {
+  if [[ ! -f "${CONF_DIR}/hecate.yaml" ]]; then
+    return 0
+  fi
+
+  local changed=0
+  if grep -Eq 'default_budget_seconds:[[:space:]]*300' "${CONF_DIR}/hecate.yaml"; then
+    sed -Ei 's/(default_budget_seconds:[[:space:]]*)300/\11380/' "${CONF_DIR}/hecate.yaml"
+    echo "[install] migrated default_budget_seconds 300 -> 1380 in ${CONF_DIR}/hecate.yaml"
+    changed=1
+  fi
+  if grep -Eq 'runtime_safety_factor:[[:space:]]*1\.10' "${CONF_DIR}/hecate.yaml"; then
+    sed -Ei 's/(runtime_safety_factor:[[:space:]]*)1\.10/\11.25/' "${CONF_DIR}/hecate.yaml"
+    echo "[install] migrated runtime_safety_factor 1.10 -> 1.25 in ${CONF_DIR}/hecate.yaml"
+    changed=1
+  fi
+
+  local role
+  role="$(read_hecate_role)"
+  if [[ "${role}" == "peer" ]]; then
+    if grep -Eq '^ssh_managed_nodes:[[:space:]]*$' "${CONF_DIR}/hecate.yaml" \
+      && grep -Eq '^  - titan-db$' "${CONF_DIR}/hecate.yaml" \
+      && grep -Eq '^  - titan-24$' "${CONF_DIR}/hecate.yaml" \
+      && ! grep -Eq '^  - titan-0a$' "${CONF_DIR}/hecate.yaml"; then
+      perl -0pi -e 's#ssh_managed_nodes:\n  - titan-db\n  - titan-24\n#ssh_managed_nodes:\n  - titan-db\n  - titan-0a\n  - titan-0b\n  - titan-0c\n  - titan-12\n  - titan-14\n  - titan-15\n  - titan-17\n  - titan-18\n  - titan-22\n  - titan-24\n#s' "${CONF_DIR}/hecate.yaml"
+      echo "[install] expanded peer ssh_managed_nodes for bootstrap fallback coverage"
+      changed=1
+    fi
+  fi
+
+  if [[ "${changed}" -eq 1 ]]; then
+    chmod 0640 "${CONF_DIR}/hecate.yaml" || true
+  fi
+}
+
 ensure_apt_packages() {
   local missing=()
   for pkg in "$@"; do
@@ -203,6 +238,7 @@ if [[ ! -f "${CONF_DIR}/hecate.yaml" ]]; then
 else
   echo "[install] keeping existing config at ${CONF_DIR}/hecate.yaml"
 fi
+migrate_hecate_config
 
 echo "[install] installing systemd units"
 install -m 0644 deploy/systemd/hecate.service "${SYSTEMD_DIR}/hecate.service"