diff --git a/hermes_cli/vault.py b/hermes_cli/vault.py
index 8033556bea..d936639377 100644
--- a/hermes_cli/vault.py
+++ b/hermes_cli/vault.py
@@ -196,7 +196,10 @@ def _cmd_key(args) -> None:
             return
         store.migrate_key(target)
         _set_key_storage(target)
-        if target == "keychain":
+        if store.key_location()["storage"] == "none":  # nothing was moved or verified, only the setting
+            c.print(f"No vault key exists yet. The first saved item creates one in "
+                    f"{'the OS keychain' if target == 'keychain' else 'vault.key'} (vault.key_storage = {target}).")
+        elif target == "keychain":
             c.print(f"[green]Vault key moved to the OS keychain[/] ({vault_keychain.backend_label()}); "
                     "vault.key was removed after the keychain copy decrypted the vault.")
             c.print("[dim]Backups of this profile now hold the encrypted vault without its key; "
diff --git a/tests/hermes_cli/test_vault_key_cli.py b/tests/hermes_cli/test_vault_key_cli.py
index 7bfdb15503..1acd49b986 100644
--- a/tests/hermes_cli/test_vault_key_cli.py
+++ b/tests/hermes_cli/test_vault_key_cli.py
@@ -64,3 +64,13 @@ def test_vault_key_migrate_moves_the_key_and_records_the_choice(hermes, capsys):
     assert (home / "vault" / "vault.key").exists() and backend.entries == {}
     assert load_config()["vault"]["key_storage"] == "file"
     assert VaultStore().resolve_secret(item)["password"] == "dummy-pw-cli-9"
+
+
+@pytest.mark.parametrize("target", ["keychain", "file"])
+def test_migrating_an_empty_vault_says_no_key_exists_yet(hermes, capsys, target):
+    run, backend, home = hermes
+    run("key", "migrate", "--to", target)
+    out = capsys.readouterr().out
+    assert "No vault key exists yet" in out
+    assert "decrypted" not in out and "moved" not in out, "nothing was moved or verified"
+    assert backend.entries == {} and not (home / "vault" / "vault.key").exists()