diff --git a/options/locale/locale_en-US.json b/options/locale/locale_en-US.json
index ede582627a..4498502703 100644
--- a/options/locale/locale_en-US.json
+++ b/options/locale/locale_en-US.json
@@ -1119,6 +1119,7 @@
   "repo.migrate.clone_address_desc": "The HTTP(S), Git, or SSH 'clone' URL of an existing repository",
   "repo.migrate.github_token_desc": "You can put one or more tokens here, separated by commas, to make migrating faster by circumventing the GitHub API rate limit. WARNING: Abusing this feature may violate the service provider's policy and may lead to getting your account(s) blocked.",
   "repo.migrate.clone_local_path": "or a local server path",
+  "repo.migrate.ssh_not_supported_for_forge": "SSH clone URLs are only supported for the plain Git migration. To use SSH against this forge, switch to the Git service.",
   "repo.migrate.ssh_helper_title": "SSH URLs",
   "repo.migrate.ssh_helper_desc": "Upload your SSH mirror keys to the remote SSH server for authentication.",
   "repo.migrate.ssh_helper_link": "View your SSH keys (if migrating to an organization, you may need to upload the organization's SSH keys).",
diff --git a/routers/web/repo/migrate.go b/routers/web/repo/migrate.go
index 0f094fcb81..446cbac8a6 100644
--- a/routers/web/repo/migrate.go
+++ b/routers/web/repo/migrate.go
@@ -69,7 +69,9 @@ func Migrate(ctx *context.Context) {
 		return
 	}
 	ctx.Data["ContextUser"] = ctxUser
-	setManagedSSHKeyFingerprints(ctx, ctxUser)
+	if serviceType == structs.PlainGitService {
+		setManagedSSHKeyFingerprints(ctx, ctxUser)
+	}
 
 	ctx.HTML(http.StatusOK, templates.TplName("repo/migrate/"+serviceType.Name()))
 }
@@ -204,7 +206,9 @@ func MigratePost(ctx *context.Context) {
 		return
 	}
 	ctx.Data["ContextUser"] = ctxUser
-	setManagedSSHKeyFingerprints(ctx, ctxUser)
+	if form.Service == structs.PlainGitService {
+		setManagedSSHKeyFingerprints(ctx, ctxUser)
+	}
 
 	tpl := templates.TplName("repo/migrate/" + form.Service.Name())
 
@@ -213,6 +217,15 @@ func MigratePost(ctx *context.Context) {
 		return
 	}
 
+	// Managed SSH keys are only wired up for the plain Git migration form.
+	// Forge migrations (GitHub/GitLab/etc.) authenticate against both the
+	// git remote and the forge API with a token, so reject ssh:// here.
+	if form.Service != structs.PlainGitService && ssh_module.IsSSHURL(strings.TrimSpace(form.CloneAddr)) {
+		ctx.Data["Err_CloneAddr"] = true
+		ctx.RenderWithErrDeprecated(ctx.Tr("repo.migrate.ssh_not_supported_for_forge"), tpl, form)
+		return
+	}
+
 	remoteAddr, err := git.ParseRemoteAddr(form.CloneAddr, form.AuthUsername, form.AuthPassword)
 	if err == nil {
 		err = migrations.IsMigrateURLAllowed(remoteAddr, ctx.Doer)
diff --git a/templates/repo/migrate/codebase.tmpl b/templates/repo/migrate/codebase.tmpl
index d5497e10bc..33fd9a2e8c 100644
--- a/templates/repo/migrate/codebase.tmpl
+++ b/templates/repo/migrate/codebase.tmpl
@@ -19,15 +19,14 @@
 					</span>
 				</div>
 
-				<div class="inline field {{if .Err_Auth}}error{{end}} auth-userpass-field">
+				<div class="inline field {{if .Err_Auth}}error{{end}}">
 					<label for="auth_username">{{ctx.Locale.Tr "username"}}</label>
 					<input id="auth_username" name="auth_username" value="{{.auth_username}}" {{if not .auth_username}}data-need-clear="true"{{end}}>
 				</div>
-				<div class="inline field {{if .Err_Auth}}error{{end}} auth-userpass-field">
+				<div class="inline field {{if .Err_Auth}}error{{end}}">
 					<label for="auth_password">{{ctx.Locale.Tr "password"}}</label>
 					<input id="auth_password" name="auth_password" type="password" value="{{.auth_password}}">
 				</div>
-				{{template "repo/migrate/ssh_options" .}}
 
 				{{template "repo/migrate/options" .}}
 
diff --git a/templates/repo/migrate/gitbucket.tmpl b/templates/repo/migrate/gitbucket.tmpl
index db60603651..8a77274a39 100644
--- a/templates/repo/migrate/gitbucket.tmpl
+++ b/templates/repo/migrate/gitbucket.tmpl
@@ -19,15 +19,14 @@
 					</span>
 				</div>
 
-				<div class="inline field {{if .Err_Auth}}error{{end}} auth-userpass-field">
+				<div class="inline field {{if .Err_Auth}}error{{end}}">
 					<label for="auth_username">{{ctx.Locale.Tr "username"}}</label>
 					<input id="auth_username" name="auth_username" value="{{.auth_username}}" {{if not .auth_username}}data-need-clear="true"{{end}}>
 				</div>
-				<div class="inline field {{if .Err_Auth}}error{{end}} auth-userpass-field">
+				<div class="inline field {{if .Err_Auth}}error{{end}}">
 					<label for="auth_password">{{ctx.Locale.Tr "password"}}</label>
 					<input id="auth_password" name="auth_password" type="password" value="{{.auth_password}}">
 				</div>
-				{{template "repo/migrate/ssh_options" .}}
 
 				{{template "repo/migrate/options" .}}
 
diff --git a/templates/repo/migrate/gitea.tmpl b/templates/repo/migrate/gitea.tmpl
index 7308e22f61..4b5ce2f76e 100644
--- a/templates/repo/migrate/gitea.tmpl
+++ b/templates/repo/migrate/gitea.tmpl
@@ -23,7 +23,6 @@
 					<input id="auth_token" name="auth_token" type="password" autocomplete="new-password" value="{{.auth_token}}" {{if not .auth_token}} data-need-clear="true" {{end}}>
 					<a target="_blank" href="https://docs.gitea.com/development/api-usage">{{svg "octicon-question"}}</a>
 				</div>
-				{{template "repo/migrate/ssh_options" .}}
 
 				{{template "repo/migrate/options" .}}
 
diff --git a/templates/repo/migrate/github.tmpl b/templates/repo/migrate/github.tmpl
index 3e46ff2351..87a95d3ce4 100644
--- a/templates/repo/migrate/github.tmpl
+++ b/templates/repo/migrate/github.tmpl
@@ -26,7 +26,6 @@
 					{{ctx.Locale.Tr "repo.migrate.github_token_desc"}}
 					</span>
 				</div>
-				{{template "repo/migrate/ssh_options" .}}
 
 				{{template "repo/migrate/options" .}}
 
diff --git a/templates/repo/migrate/gitlab.tmpl b/templates/repo/migrate/gitlab.tmpl
index 6f6a33ec77..6754ecdfa8 100644
--- a/templates/repo/migrate/gitlab.tmpl
+++ b/templates/repo/migrate/gitlab.tmpl
@@ -23,7 +23,6 @@
 					<input id="auth_token" name="auth_token" type="password" autocomplete="new-password" value="{{.auth_token}}" {{if not .auth_token}}data-need-clear="true"{{end}}>
 					<a target="_blank" href="https://docs.gitlab.com/ee/user/profile/personal_access_tokens.html">{{svg "octicon-question"}}</a>
 				</div>
-				{{template "repo/migrate/ssh_options" .}}
 
 				{{template "repo/migrate/options" .}}
 
diff --git a/templates/repo/migrate/gogs.tmpl b/templates/repo/migrate/gogs.tmpl
index 82fd37e704..ab67c956b0 100644
--- a/templates/repo/migrate/gogs.tmpl
+++ b/templates/repo/migrate/gogs.tmpl
@@ -23,7 +23,6 @@
 					<input id="auth_token" name="auth_token" type="password" autocomplete="new-password" value="{{.auth_token}}" {{if not .auth_token}} data-need-clear="true" {{end}}>
 					<!-- <a target="_blank" href="https://docs.gitea.com/development/api-usage">{{svg "octicon-question"}}</a> -->
 				</div>
-				{{template "repo/migrate/ssh_options" .}}
 
 				{{template "repo/migrate/options" .}}
 
diff --git a/templates/repo/migrate/onedev.tmpl b/templates/repo/migrate/onedev.tmpl
index 135c0787a8..f176a3f758 100644
--- a/templates/repo/migrate/onedev.tmpl
+++ b/templates/repo/migrate/onedev.tmpl
@@ -19,15 +19,14 @@
 					</span>
 				</div>
 
-				<div class="inline field {{if .Err_Auth}}error{{end}} auth-userpass-field">
+				<div class="inline field {{if .Err_Auth}}error{{end}}">
 					<label for="auth_username">{{ctx.Locale.Tr "username"}}</label>
 					<input id="auth_username" name="auth_username" value="{{.auth_username}}" {{if not .auth_username}}data-need-clear="true"{{end}}>
 				</div>
-				<div class="inline field {{if .Err_Auth}}error{{end}} auth-userpass-field">
+				<div class="inline field {{if .Err_Auth}}error{{end}}">
 					<label for="auth_password">{{ctx.Locale.Tr "password"}}</label>
 					<input id="auth_password" name="auth_password" type="password" value="{{.auth_password}}">
 				</div>
-				{{template "repo/migrate/ssh_options" .}}
 
 				{{template "repo/migrate/options" .}}