diff --git a/awx/main/migrations/_rbac.py b/awx/main/migrations/_rbac.py
index ee4100431e..4a1115c4b3 100644
--- a/awx/main/migrations/_rbac.py
+++ b/awx/main/migrations/_rbac.py
@@ -198,7 +198,8 @@ def migrate_credential(apps, schema_editor):
             logger.info(smart_text(u"added Credential(name={}, kind={}, host={}) at organization level".format(cred.name, cred.kind, cred.host)))
 
         if cred.deprecated_team is not None:
-            cred.deprecated_team.member_role.children.add(cred.admin_role)
+            cred.deprecated_team.admin_role.children.add(cred.admin_role)
+            cred.deprecated_team.member_role.children.add(cred.use_role)
             cred.save()
             logger.info(smart_text(u"added Credential(name={}, kind={}, host={}) at user level".format(cred.name, cred.kind, cred.host)))
         elif cred.deprecated_user is not None: