diff --git a/.gitignore b/.gitignore
index 73ed73f..2c41660 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,3 +3,4 @@
 *spec-20*
 *.tar.xz
 *.bak
+*gz
diff --git a/root/etc/e-smith/db/accounts/defaults/Primary/SSLRequireSSL b/root/etc/e-smith/db/accounts/defaults/Primary/SSLRequireSSL
new file mode 100644
index 0000000..86981e6
--- /dev/null
+++ b/root/etc/e-smith/db/accounts/defaults/Primary/SSLRequireSSL
@@ -0,0 +1 @@
+enabled
diff --git a/root/etc/e-smith/db/accounts/defaults/primary/type b/root/etc/e-smith/db/accounts/defaults/primary/type
deleted file mode 100644
index bec3a35..0000000
--- a/root/etc/e-smith/db/accounts/defaults/primary/type
+++ /dev/null
@@ -1 +0,0 @@
-system
diff --git a/root/etc/e-smith/db/accounts/migrate/10primary b/root/etc/e-smith/db/accounts/migrate/10primary
new file mode 100644
index 0000000..506e092
--- /dev/null
+++ b/root/etc/e-smith/db/accounts/migrate/10primary
@@ -0,0 +1,10 @@
+{
+    # Delete any pre-existing primary=system record (all lower case)
+    my $p = $DB->get('primary');
+    return unless defined $p;
+
+    my $type = $p->prop('type');
+    return unless defined $type;
+
+    $p->delete if $type eq 'system';
+}
diff --git a/smeserver-base.spec b/smeserver-base.spec
index 9f6db96..2e32511 100644
--- a/smeserver-base.spec
+++ b/smeserver-base.spec
@@ -4,7 +4,7 @@ Summary: smeserver server and gateway - base module
 %define name smeserver-base
 Name: %{name}
 %define version 11.0.0
-%define release 19
+%define release 20
 Version: %{version}
 Release: %{release}%{?dist}
 License: GPL
@@ -184,6 +184,10 @@ fi
 
 
 %changelog
+* Thu Jan 02 2025 Jean-Philippe Pialasse <jpp@koozali.org> 11.0.0-20.sme
+- Primary default to SSL required and redirect [SME: 12858]
+- cleanup remove primary=system [SME: 8268]
+
 * Tue Dec 31 2024 Jean-Philippe Pialasse <jpp@koozali.org> 11.0.0-19.sme
 - fix www removed from shared on group creation [SME: 12848]