diff --git a/migrations/cassandra/keyspaces/ess_api/05_add_nvct_authorizations.up.sql b/migrations/cassandra/keyspaces/ess_api/05_add_nvct_authorizations.up.sql
new file mode 100644
index 000000000..3c53a747f
--- /dev/null
+++ b/migrations/cassandra/keyspaces/ess_api/05_add_nvct_authorizations.up.sql
@@ -0,0 +1,25 @@
+-- Register nvct-api for legacy ESS authentication during the 0.6.x release.
+--
+-- The 0.6.x ESS API validates service assertions from ssa_authorizations and
+-- validates task-secret reads from notary_authorizations.
+UPDATE ess_api.namespaces
+SET
+  ssa_authorizations = ssa_authorizations + {
+    'nvct-api': {
+      id: 'nvct-api',
+      name: 'nvct api service client',
+      jwks_url: 'http://openbao-server.vault-system.svc.cluster.local:8200/v1/services/ess-api/jwt/jwks',
+      issuer: 'http://ess-api.ess.svc.cluster.local',
+      type: 'SSA'
+    }
+  },
+  notary_authorizations = notary_authorizations + {
+    'nvct-api': {
+      id: 'nvct-api',
+      name: 'nvct api notary client',
+      jwks_url: 'http://notary.nvcf.svc.cluster.local:8080/.well-known/jwks.json',
+      issuer: 'http://notary.nvcf.svc.cluster.local:8080',
+      type: 'NOTARY'
+    }
+  }
+WHERE namespace = 'nvcf';
diff --git a/migrations/cassandra/tests/test-execute-sqls.sh b/migrations/cassandra/tests/test-execute-sqls.sh
index 28601d511..031ba807a 100755
--- a/migrations/cassandra/tests/test-execute-sqls.sh
+++ b/migrations/cassandra/tests/test-execute-sqls.sh
@@ -37,6 +37,26 @@ for keyspace_name in ${schema_inventory}; do
   done
 done
 
+ess_nvct_authorizations="${keyspaces}/ess_api/05_add_nvct_authorizations.up.sql"
+if [ ! -f "${ess_nvct_authorizations}" ]; then
+  fail "ess_api is missing the nvct-api authorization migration"
+else
+  ssa_registration=$(sed -n '/ssa_authorizations = ssa_authorizations + {/,/^  },$/p' "${ess_nvct_authorizations}")
+  notary_registration=$(sed -n '/notary_authorizations = notary_authorizations + {/,/^  }$/p' "${ess_nvct_authorizations}")
+
+  if ! printf '%s\n' "${ssa_registration}" | grep -F -q "'nvct-api': {" || \
+    ! printf '%s\n' "${ssa_registration}" | grep -F -q "type: 'SSA'"
+  then
+    fail "ess_api does not register nvct-api for SSA authentication"
+  fi
+
+  if ! printf '%s\n' "${notary_registration}" | grep -F -q "'nvct-api': {" || \
+    ! printf '%s\n' "${notary_registration}" | grep -F -q "type: 'NOTARY'"
+  then
+    fail "ess_api does not register nvct-api for notary authentication"
+  fi
+fi
+
 if grep -R -n -F 'envOrDefault "REPLICA_COUNT"' "${keyspaces}"; then
   fail "keyspace migrations contain templates unsupported by stock golang-migrate"
 fi