diff --git a/changelog.d/assign-app-user-oom.fix b/changelog.d/assign-app-user-oom.fix
new file mode 100644
index 000000000..ac1de7159
--- /dev/null
+++ b/changelog.d/assign-app-user-oom.fix
@@ -0,0 +1 @@
+Fix AssignAppUser migration OOM
diff --git a/priv/repo/migrations/20240904142434_assign_app_user.exs b/priv/repo/migrations/20240904142434_assign_app_user.exs
index 11bec529b..74740220d 100644
--- a/priv/repo/migrations/20240904142434_assign_app_user.exs
+++ b/priv/repo/migrations/20240904142434_assign_app_user.exs
@@ -1,20 +1,24 @@
 defmodule Pleroma.Repo.Migrations.AssignAppUser do
   use Ecto.Migration
 
+  import Ecto.Query
+
   alias Pleroma.Repo
   alias Pleroma.Web.OAuth.App
   alias Pleroma.Web.OAuth.Token
 
   def up do
-    Repo.all(Token)
-    |> Enum.group_by(fn x -> Map.get(x, :app_id) end)
-    |> Enum.each(fn {_app_id, tokens} ->
-      token =
-        Enum.filter(tokens, fn x -> not is_nil(x.user_id) end)
-        |> List.first()
-
+    Token
+    |> where([t], not is_nil(t.user_id))
+    |> group_by([t], t.app_id)
+    |> select([t], %{app_id: t.app_id, id: min(t.id)})
+    |> order_by(asc: :app_id)
+    |> Repo.stream()
+    |> Stream.each(fn %{id: id} ->
+      token = Token.Query.get_by_id(id) |> Repo.one()
       App.maybe_update_owner(token)
     end)
+    |> Stream.run()
   end
 
   def down, do: :ok