diff --git a/src/main/java/com/knecon/fforesight/tenantusermanagement/initializer/MigrateOnlyHook.java b/src/main/java/com/knecon/fforesight/tenantusermanagement/initializer/MigrateOnlyHook.java
index 342dd2d..b3f2199 100644
--- a/src/main/java/com/knecon/fforesight/tenantusermanagement/initializer/MigrateOnlyHook.java
+++ b/src/main/java/com/knecon/fforesight/tenantusermanagement/initializer/MigrateOnlyHook.java
@@ -1,5 +1,6 @@
 package com.knecon.fforesight.tenantusermanagement.initializer;
 
+import com.knecon.fforesight.tenantusermanagement.service.TenantManagementService;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.boot.ApplicationArguments;
 import org.springframework.boot.SpringApplication;
@@ -24,10 +25,19 @@ public class MigrateOnlyHook {
 
     private final ApplicationContext ctx;
 
+    private final TenantManagementService tenantManagementService;
+
+    private final KeyCloakRoleManagerService keyCloakRoleManagerService;
+
 
     @SuppressWarnings("PMD.DoNotTerminateVM")
     @EventListener(ApplicationReadyEvent.class)
     public void migrate() {
+
+        tenantManagementService.getTenants().forEach(tenant -> {
+                keyCloakRoleManagerService.updateRoles(tenant.getTenantId());
+        });
+
         // This should only run in post upgrade hook
         if (isMigrateOnly) {
             System.exit(SpringApplication.exit(ctx, () -> 0));