diff --git a/modules/vault_cluster/state_migrations.tf b/modules/vault_cluster/state_migrations.tf
index e9a2020..03a852a 100644
--- a/modules/vault_cluster/state_migrations.tf
+++ b/modules/vault_cluster/state_migrations.tf
@@ -338,6 +338,12 @@ moved {
   to   = module.vault_policy["sshca/sign/host"].vault_policy.this
 }
 
+# The SSH host signing policy is named after the sshca role it grants (signhost)
+moved {
+  from = module.vault_policy["sshca/sign/host"].vault_policy.this
+  to   = module.vault_policy["sshca/sign/signhost"].vault_policy.this
+}
+
 moved {
   from = vault_policy.policies["sys/sys_audit_read"]
   to   = module.vault_policy["sys/audit/read"].vault_policy.this
diff --git a/policies/sshca/sign/host.yaml b/policies/sshca/sign/signhost.yaml
similarity index 84%
rename from policies/sshca/sign/host.yaml
rename to policies/sshca/sign/signhost.yaml
index 5f99869..4a5b474 100644
--- a/policies/sshca/sign/host.yaml
+++ b/policies/sshca/sign/signhost.yaml
@@ -1,7 +1,7 @@
 # Allow signing SSH host certificates
 ---
 rules:
-  - path: "sshca/sign/host"
+  - path: "sshca/sign/signhost"
     capabilities:
       - create
       - update