diff --git a/backend/config/migrate.go b/backend/config/migrate.go
index 2e59159..012d14c 100644
--- a/backend/config/migrate.go
+++ b/backend/config/migrate.go
@@ -112,7 +112,7 @@ var legacyPluginExecutableMap = map[string]string{
 	"pmail_telegram_push.exe": "telegram_push",
 }
 
-var legacyMySQLDSNPattern = regexp.MustCompile(`^([^:@/[:space:]]+):([^@\r\n]*)@tcp\(([^():/[:space:]]+)(?::([0-9]{1,5}))?\)/([A-Za-z0-9][A-Za-z0-9._-]{0,127})(?:\?[^#[:space:]]*)?$`)
+var legacyMySQLDSNPattern = regexp.MustCompile(`^([^:@/[:space:]]+):([^\r\n]*)@tcp\(([^():/[:space:]]+)(?::([0-9]{1,5}))?\)/([A-Za-z0-9][A-Za-z0-9._-]{0,127})(?:\?[^#[:space:]]*)?$`)
 
 func PlanLegacyMigration(root string, _ RuntimeValidationOptions) (LegacyMigrationPlan, error) {
 	directory, err := secureManagerConfigDirectory(root)
diff --git a/backend/config/migrate_test.go b/backend/config/migrate_test.go
index 709e9b6..ec14e8c 100644
--- a/backend/config/migrate_test.go
+++ b/backend/config/migrate_test.go
@@ -631,6 +631,15 @@ func TestMigrateLegacyConfigParsesKnownStructuredDatabaseDSNs(t *testing.T) {
 			wantHost: "db.example.com",
 			wantName: "smail",
 			password: "database-secret",
+		}, {
+			name:     "MySQL password with at sign",
+			database: DBTypeMySQL,
+			dsn:      "smail:database@secret@tcp(db.example.com:3307)/smail?charset=utf8mb4",
+			wantType: DatabaseTypeMySQL,
+			wantPort: 3307,
+			wantHost: "db.example.com",
+			wantName: "smail",
+			password: "database@secret",
 		},
 		{
 			name:     "PostgreSQL",