diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 000000000..31c103425
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,3 @@
+# see:
+# https://docs.github.com/en/github/creating-cloning-and-archiving-repositories/creating-a-repository-on-github/about-code-owners
+* @openziti/maintainers
diff --git a/controller/persistence/migration_v24.go b/controller/persistence/migration_v24.go
new file mode 100644
index 000000000..3368d454a
--- /dev/null
+++ b/controller/persistence/migration_v24.go
@@ -0,0 +1,44 @@
+package persistence
+
+import (
+	"fmt"
+	"github.com/openziti/foundation/storage/ast"
+	"github.com/openziti/foundation/storage/boltz"
+)
+
+func (m *Migrations) addIdentityIdToSessions(step *boltz.MigrationStep) {
+	cursor := m.stores.Session.IterateIds(step.Ctx.Tx(), ast.BoolNodeTrue)
+
+	fieldChecker := boltz.MapFieldChecker{
+		FieldSessionIdentity: struct{}{},
+	}
+
+	for cursor.IsValid() {
+		sessionId := string(cursor.Current())
+		session, err := m.stores.Session.LoadOneById(step.Ctx.Tx(), sessionId)
+
+		if err != nil {
+			step.SetError(fmt.Errorf("could no load session by id [%s]: %v", sessionId, err))
+			return
+		}
+
+		if session == nil {
+			step.SetError(fmt.Errorf("session [%s] load did not error but session is null", sessionId))
+			return
+		}
+
+		if session.IdentityId == "" {
+			if apiSession, err := m.stores.ApiSession.LoadOneById(step.Ctx.Tx(), session.ApiSessionId); err == nil {
+				if apiSession != nil {
+					session.IdentityId = apiSession.IdentityId
+					if err = m.stores.Session.Update(step.Ctx, session, fieldChecker); err != nil {
+						step.SetError(fmt.Errorf("could not update session [%s]: %v", session.Id, err))
+						return
+					}
+				}
+			}
+		}
+
+		cursor.Next()
+	}
+}
diff --git a/controller/persistence/migrations.go b/controller/persistence/migrations.go
index 145bef4ed..7d5c87281 100644
--- a/controller/persistence/migrations.go
+++ b/controller/persistence/migrations.go
@@ -22,7 +22,7 @@ import (
 )
 
 const (
-	CurrentDbVersion = 23
+	CurrentDbVersion = 24
 	FieldVersion     = "version"
 )
 
@@ -100,6 +100,10 @@ func (m *Migrations) migrate(step *boltz.MigrationStep) int {
 		m.addProcessMultiPostureCheck(step)
     }
 
+	if step.CurrentVersion < 24 {
+		m.addIdentityIdToSessions(step)
+	}
+
 	// current version
 	if step.CurrentVersion <= CurrentDbVersion {
 		return CurrentDbVersion
diff --git a/controller/persistence/session_store.go b/controller/persistence/session_store.go
index 0b6d9429b..09b5cd2fe 100644
--- a/controller/persistence/session_store.go
+++ b/controller/persistence/session_store.go
@@ -62,7 +62,7 @@ func (entity *Session) LoadValues(_ boltz.CrudStore, bucket *boltz.TypedBucket)
 	entity.Token = bucket.GetStringOrError(FieldSessionToken)
 	entity.ApiSessionId = bucket.GetStringOrError(FieldSessionApiSession)
 	entity.ServiceId = bucket.GetStringOrError(FieldSessionService)
-	entity.IdentityId = bucket.GetStringOrError(FieldSessionIdentity)
+	entity.IdentityId = bucket.GetStringWithDefault(FieldSessionIdentity, "")
 	entity.Type = bucket.GetStringWithDefault(FieldSessionType, "Dial")
 	entity.ServicePolicies = bucket.GetStringList(FieldSessionServicePolicies)
 }