diff --git a/backend/config/credential_store.go b/backend/config/credential_store.go
index 40581b6..ce4d898 100644
--- a/backend/config/credential_store.go
+++ b/backend/config/credential_store.go
@@ -79,6 +79,22 @@ func InitCredentialStore(cfg *Config) {
 		log.Printf("No existing credential store: %v, starting fresh", err)
 	}
 
+	// Check if load triggered ID migration and persist
+	CredStore.mu.RLock()
+	needsSave := false
+	for _, c := range CredStore.data {
+		if c.ID == 0 {
+			needsSave = true
+			break
+		}
+	}
+	CredStore.mu.RUnlock()
+	if needsSave {
+		if err := CredStore.Save(); err != nil {
+			log.Printf("Failed to persist credential migration: %v", err)
+		}
+	}
+
 	log.Println("Credential store initialized successfully")
 }
 
@@ -98,8 +114,13 @@ func (s *CredentialStore) Load() error {
 	}
 
 	s.data = make(map[uint]*Credential)
-	s.nextID = 0
+	s.nextID = 1
 	for _, c := range creds {
+		// Auto-migrate legacy ID=0 entries
+		if c.ID == 0 {
+			c.ID = s.nextID
+			s.nextID++
+		}
 		s.data[c.ID] = c
 		if c.ID >= s.nextID {
 			s.nextID = c.ID + 1
@@ -120,6 +141,13 @@ func (s *CredentialStore) save() error {
 	return os.WriteFile(s.path, data, 0600)
 }
 
+// Save persists credential data to file (public, acquires write lock)
+func (s *CredentialStore) Save() error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.save()
+}
+
 // GetAll returns all credentials
 func (s *CredentialStore) GetAll() []*Credential {
 	s.mu.RLock()