diff --git a/REFERENCE.md b/REFERENCE.md
index dcaf0f49..c0376477 100644
--- a/REFERENCE.md
+++ b/REFERENCE.md
@@ -108,6 +108,7 @@ Supported use cases:
 * [`peadm::backup_ca`](#peadm--backup_ca)
 * [`peadm::convert`](#peadm--convert): Convert an existing PE cluster to a PEAdm-managed cluster
 * [`peadm::install`](#peadm--install): Install a new PE cluster
+* [`peadm::migrate`](#peadm--migrate): Migrate a PE primary server to a new host
 * [`peadm::modify_certificate`](#peadm--modify_certificate): Modify the certificate of one or more targets
 * [`peadm::replace_failed_postgresql`](#peadm--replace_failed_postgresql): Replaces a failed PostgreSQL host
 * [`peadm::restore`](#peadm--restore): Restore puppet primary configuration
@@ -1876,7 +1877,7 @@ This should be the primary puppetserver for the puppet cluster
 
 ##### <a name="-peadm--backup--backup_type"></a>`backup_type`
 
-Data type: `Enum['recovery', 'custom']`
+Data type: `Enum['recovery', 'custom', 'migration']`
 
 Currently, the recovery and custom backup types are supported
 
@@ -2311,6 +2312,29 @@ Data type: `String`
 
 Default value: `'1y'`
 
+### <a name="peadm--migrate"></a>`peadm::migrate`
+
+Migrate a PE primary server to a new host
+
+#### Parameters
+
+The following parameters are available in the `peadm::migrate` plan:
+
+* [`old_primary_host`](#-peadm--migrate--old_primary_host)
+* [`new_primary_host`](#-peadm--migrate--new_primary_host)
+
+##### <a name="-peadm--migrate--old_primary_host"></a>`old_primary_host`
+
+Data type: `Peadm::SingleTargetSpec`
+
+The existing PE primary server that will be migrated from
+
+##### <a name="-peadm--migrate--new_primary_host"></a>`new_primary_host`
+
+Data type: `Peadm::SingleTargetSpec`
+
+The new server that will become the PE primary server
+
 ### <a name="peadm--modify_certificate"></a>`peadm::modify_certificate`
 
 Certificates can be modified by adding extensions, removing extensions, or
@@ -2444,7 +2468,7 @@ This should be the primary puppetserver for the puppet cluster
 
 ##### <a name="-peadm--restore--restore_type"></a>`restore_type`
 
-Data type: `Enum['recovery', 'recovery-db', 'custom']`
+Data type: `Enum['recovery', 'recovery-db', 'custom', 'migration']`
 
 Choose from `recovery`, `recovery-db` and `custom`
 
diff --git a/functions/migration_opts_default.pp b/functions/migration_opts_default.pp
index 99b57e55..a096d9a9 100644
--- a/functions/migration_opts_default.pp
+++ b/functions/migration_opts_default.pp
@@ -7,6 +7,6 @@ function peadm::migration_opts_default () {
     'config'       => false,
     'orchestrator' => true,
     'puppetdb'     => true,
-    'rbac'         => true,
+    'rbac'         => false,
   }
 }
diff --git a/plans/backup.pp b/plans/backup.pp
index 80835eb0..5d78a7ea 100644
--- a/plans/backup.pp
+++ b/plans/backup.pp
@@ -12,7 +12,7 @@
   Peadm::SingleTargetSpec     $targets,
 
   # backup type determines the backup options
-  Enum['recovery', 'custom']  $backup_type = 'recovery',
+  Enum['recovery', 'custom', 'migration']  $backup_type = 'recovery',
 
   # Which data to backup
   Peadm::Recovery_opts        $backup = {},
diff --git a/plans/migrate.pp b/plans/migrate.pp
new file mode 100644
index 00000000..c9aa7197
--- /dev/null
+++ b/plans/migrate.pp
@@ -0,0 +1,43 @@
+# @summary Migrate a PE primary server to a new host
+#
+# @param old_primary_host
+#   The existing PE primary server that will be migrated from
+# @param new_primary_host
+#   The new server that will become the PE primary server
+#
+plan peadm::migrate (
+  Peadm::SingleTargetSpec $old_primary_host,
+  Peadm::SingleTargetSpec $new_primary_host,
+) {
+  peadm::assert_supported_bolt_version()
+
+  $backup_file = run_plan('peadm::backup', $old_primary_host, {
+      backup_type => 'migration',
+  })
+
+  download_file($backup_file['path'], 'backup', $old_primary_host)
+
+  $backup_filename = basename($backup_file['path'])
+  $remote_backup_path = "/tmp/${backup_filename}"
+  $current_dir = system::env('PWD')
+
+  upload_file("${current_dir}/downloads/backup/${old_primary_host}/${backup_filename}", $remote_backup_path, $new_primary_host)
+
+  $old_primary_target = get_targets($old_primary_host)[0]
+  $old_primary_password = peadm::get_pe_conf($old_primary_target)['console_admin_password']
+  $old_pe_conf = run_task('peadm::get_peadm_config', $old_primary_target).first.value
+
+  run_plan('peadm::install', {
+      primary_host                => $new_primary_host,
+      console_password            => $old_primary_password,
+      code_manager_auto_configure => true,
+      download_mode               => 'direct',
+      version                     => $old_pe_conf['pe_version'],
+  })
+
+  run_plan('peadm::restore', {
+      targets => $new_primary_host,
+      restore_type => 'migration',
+      input_file => $remote_backup_path,
+  })
+}
diff --git a/plans/restore.pp b/plans/restore.pp
index 453bf8e5..bbb8bd95 100644
--- a/plans/restore.pp
+++ b/plans/restore.pp
@@ -12,7 +12,7 @@
   Peadm::SingleTargetSpec $targets,
 
   # restore type determines the restore options
-  Enum['recovery', 'recovery-db', 'custom'] $restore_type = 'recovery',
+  Enum['recovery', 'recovery-db', 'custom', 'migration'] $restore_type = 'recovery',
 
   # Which data to restore
   Peadm::Recovery_opts $restore = {},