diff --git a/CHANGELOG.md b/CHANGELOG.md
index 09947917d0..5d101790c7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 - Fixed installation of debian packages on distros without preinstalled `at` ([#1216](https://github.com/scm-manager/scm-manager/issues/1216) and [#1217](https://github.com/scm-manager/scm-manager/pull/1217))
+- Fixed broken migration with empty security.xml ([#1219](https://github.com/scm-manager/scm-manager/issues/1219) and [#1221](https://github.com/scm-manager/scm-manager/pull/1221))
 
 ## [2.1.1] - 2020-06-23
 ### Fixed
diff --git a/scm-webapp/src/main/java/sonia/scm/update/security/XmlSecurityV1UpdateStep.java b/scm-webapp/src/main/java/sonia/scm/update/security/XmlSecurityV1UpdateStep.java
index 11d90712d1..11a4a17fac 100644
--- a/scm-webapp/src/main/java/sonia/scm/update/security/XmlSecurityV1UpdateStep.java
+++ b/scm-webapp/src/main/java/sonia/scm/update/security/XmlSecurityV1UpdateStep.java
@@ -21,7 +21,7 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
  */
-    
+
 package sonia.scm.update.security;
 
 import org.slf4j.Logger;
@@ -44,6 +44,7 @@ import javax.xml.bind.annotation.XmlElement;
 import javax.xml.bind.annotation.XmlRootElement;
 import java.io.File;
 import java.nio.file.Path;
+import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
 import java.util.function.Consumer;
@@ -179,7 +180,7 @@ public class XmlSecurityV1UpdateStep implements UpdateStep {
   @XmlRootElement(name = "configuration")
   private static class V1Security {
     @XmlElement(name = "entry")
-    private List<Entry> entries;
+    private List<Entry> entries = new ArrayList<>();
   }
 
   @XmlAccessorType(XmlAccessType.FIELD)
diff --git a/scm-webapp/src/test/java/sonia/scm/update/security/XmlSecurityV1UpdateStepTest.java b/scm-webapp/src/test/java/sonia/scm/update/security/XmlSecurityV1UpdateStepTest.java
index 559b181199..9dc506e919 100644
--- a/scm-webapp/src/test/java/sonia/scm/update/security/XmlSecurityV1UpdateStepTest.java
+++ b/scm-webapp/src/test/java/sonia/scm/update/security/XmlSecurityV1UpdateStepTest.java
@@ -43,6 +43,7 @@ import java.net.URL;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.List;
+import java.util.Map;
 
 import static java.util.stream.Collectors.toList;
 import static org.assertj.core.api.Assertions.assertThat;
@@ -107,15 +108,17 @@ class XmlSecurityV1UpdateStepTest {
   @Nested
   class WithExistingSecurityXml {
 
+    private Path configDir;
+
     @BeforeEach
     void createSecurityV1XML(@TempDir Path tempDir) throws IOException {
-      Path configDir = tempDir.resolve("config");
+      configDir = tempDir.resolve("config");
       Files.createDirectories(configDir);
-      copyTestDatabaseFile(configDir, "securityV1.xml");
     }
 
     @Test
-    void shouldMapV1PermissionsFromSecurityV1XML() throws JAXBException {
+    void shouldMapV1PermissionsFromSecurityV1XML() throws IOException, JAXBException {
+      copyTestDatabaseFile(configDir, "securityV1.xml");
       updateStep.doUpdate();
       List<String> assignedPermission =
         assignedPermissionStore.getAll().values()
@@ -127,15 +130,27 @@ class XmlSecurityV1UpdateStepTest {
       assertThat(assignedPermission).contains("test");
     }
 
+    @Test
+    void shouldNotFailOnEmptyV1SecurityXml() throws IOException, JAXBException {
+      copyTestDatabaseFile(configDir, "emptySecurityV1.xml", "securityV1.xml");
+      updateStep.doUpdate();
+      assertThat(assignedPermissionStore.getAll()).isEmpty();
+    }
+
   }
 
   private void copyTestDatabaseFile(Path configDir, String fileName) throws IOException {
-    URL url = Resources.getResource("sonia/scm/update/security/" + fileName);
-    Files.copy(url.openStream(), configDir.resolve(fileName));
+    copyTestDatabaseFile(configDir, fileName, fileName);
+  }
+
+  private void copyTestDatabaseFile(Path configDir, String sourceFileName, String targetFileName) throws IOException {
+    URL url = Resources.getResource("sonia/scm/update/security/" + sourceFileName);
+    Files.copy(url.openStream(), configDir.resolve(targetFileName));
   }
 
   @Test
   void shouldNotFailForMissingConfigDir() throws JAXBException {
     updateStep.doUpdate();
+    assertThat(assignedPermissionStore.getAll()).isEmpty();
   }
 }
diff --git a/scm-webapp/src/test/resources/sonia/scm/update/security/emptySecurityV1.xml b/scm-webapp/src/test/resources/sonia/scm/update/security/emptySecurityV1.xml
new file mode 100644
index 0000000000..c6c16aee28
--- /dev/null
+++ b/scm-webapp/src/test/resources/sonia/scm/update/security/emptySecurityV1.xml
@@ -0,0 +1,28 @@
+<?xml version="1.0" ?>
+<!--
+
+    MIT License
+
+    Copyright (c) 2020-present Cloudogu GmbH and Contributors
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+
+-->
+<configuration>
+</configuration>