diff --git a/server/channels/app/authentication.go b/server/channels/app/authentication.go
index 278ece11ddd..7e4d1137e3b 100644
--- a/server/channels/app/authentication.go
+++ b/server/channels/app/authentication.go
@@ -83,7 +83,9 @@ func (a *App) checkUserPassword(user *model.User, password string) *model.AppErr
 
 	// Migrate the password if needed
 	if !hashers.IsLatestHasher(hasher) {
-		return a.migratePassword(user, password)
+		if err := a.migratePassword(user, password); err != nil {
+			return model.AsAppError(err)
+		}
 	}
 
 	return nil
@@ -91,7 +93,7 @@ func (a *App) checkUserPassword(user *model.User, password string) *model.AppErr
 
 // migratePassword updates the database with the user's password hashed with the
 // latest hashing method. It assumes that the password has been already validated.
-func (a *App) migratePassword(user *model.User, password string) *model.AppError {
+func (a *App) migratePassword(user *model.User, password string) error {
 	// Compute the new hash with the latest hashing method
 	newHash, err := hashers.Hash(password)
 	if err != nil {
diff --git a/server/channels/app/authentication_test.go b/server/channels/app/authentication_test.go
index f8fe022df45..aeb79db9823 100644
--- a/server/channels/app/authentication_test.go
+++ b/server/channels/app/authentication_test.go
@@ -804,15 +804,15 @@ func TestMigratePassword(t *testing.T) {
 		user := createUserWithHash(pwdBcrypt)
 
 		err := th.App.migratePassword(user, pwd)
-		require.Nil(t, err)
+		require.NoError(t, err)
 
-		updatedUser, err := th.App.GetUser(th.Context, user.Id)
-		require.Nil(t, err)
+		updatedUser, appErr := th.App.GetUser(th.Context, user.Id)
+		require.Nil(t, appErr)
 		require.NotEqual(t, pwdBcrypt, updatedUser.Password)
 		require.Contains(t, updatedUser.Password, "$pbkdf2")
 
 		// Re-check with updated password
-		err = th.App.checkUserPassword(updatedUser, pwd)
-		require.Nil(t, err)
+		appErr = th.App.checkUserPassword(updatedUser, pwd)
+		require.Nil(t, appErr)
 	})
 }