The Migration Tool is missing a handler for Elytron's secret-key-credential-store which leads to regeneration of secret keys at the target server which then invalidates all the encrypted expressions in the target server configuration.