diff --git a/plugins/auth-backend/migrations/20251118120000_oauth_state_text.js b/plugins/auth-backend/migrations/20251118120000_oauth_state_text.js
index 3dbef647d4..41e128ec20 100644
--- a/plugins/auth-backend/migrations/20251118120000_oauth_state_text.js
+++ b/plugins/auth-backend/migrations/20251118120000_oauth_state_text.js
@@ -29,6 +29,12 @@ exports.up = async function up(knex) {
  * @param {import('knex').Knex} knex
  */
 exports.down = async function down(knex) {
+  // Delete sessions with state > 255 chars since they won't fit in varchar(255)
+  // These sessions would be unusable with truncated state anyway
+  await knex('oauth_authorization_sessions')
+    .whereRaw('LENGTH(state) > 255')
+    .delete();
+
   await knex.schema.alterTable('oauth_authorization_sessions', table => {
     table.string('state').nullable().alter();
   });