diff --git a/README.md b/README.md
index a16dc8a..2cb4b83 100644
--- a/README.md
+++ b/README.md
@@ -94,9 +94,6 @@ byc zapisany bez sekretu:
 git remote add r1 http://77.90.8.171:3001/edu-tools/rv-launcher.git
 ```
 
-Launcher umie tez przemigrowac stary plik `tokens/gitea_tokens.json` do nowego
-`tokens/tokens.json`.
-
 Podstawowe komendy tokenow:
 
 ```bash
diff --git a/doc/tokens.md b/doc/tokens.md
index 2cf2c10..e7dd9fc 100644
--- a/doc/tokens.md
+++ b/doc/tokens.md
@@ -69,23 +69,6 @@ Przy skanowaniu launcher zapisuje tez metadane serwera:
 - `host`
 - `port`
 
-## Migracja starego pliku
-
-Jesli istnieje stary plik:
-
-```text
-~/dev/workspace/rv/tokens/gitea_tokens.json
-```
-
-launcher przemigruje go do:
-
-```text
-~/dev/workspace/rv/tokens/tokens.json
-```
-
-Jesli plik ma jeszcze stary format `users -> tokens`, launcher zamieni go na
-nowy format `servers -> users -> tokens`.
-
 ## Komendy
 
 ### `tokens scan`
diff --git a/doc/workspace.md b/doc/workspace.md
index f32b724..6ec346c 100644
--- a/doc/workspace.md
+++ b/doc/workspace.md
@@ -89,9 +89,6 @@ sam wykonywac `clone`, `fetch` i `push`, albo gdy uzytkownik po zajeciach chce
 pracowac z wieloma repo na swoim koncie bez wpisywania tokena do kazdego
 remota.
 
-Launcher umie tez przemigrowac stary plik `tokens/gitea_tokens.json` do nowego
-`tokens/tokens.json`.
-
 ### Fetch i switch
 
 Domyslna galaz launchera to `main`.
diff --git a/workspace.py b/workspace.py
index 71d58b5..c9de00c 100755
--- a/workspace.py
+++ b/workspace.py
@@ -40,7 +40,6 @@ class WorkspaceConfig:
     series_root: Path
     socket_root: Path
     token_path: Path
-    legacy_token_path: Path
     tools_root_candidates: list[Path]
     tools_root: Path
     defaults: dict[str, str]
@@ -55,10 +54,6 @@ def load_config(config_path: Path) -> WorkspaceConfig:
     series_root = expand_path(raw.get("series_root", str(workspace_root / "series")), base_dir)
     socket_root = expand_path(raw.get("socket_root", str(workspace_root / "sockets")), base_dir)
     token_path = expand_path(raw.get("token_file", str(workspace_root / "tokens" / "tokens.json")), base_dir)
-    legacy_token_path = expand_path(
-        raw.get("legacy_token_file", str(workspace_root / "tokens" / "gitea_tokens.json")),
-        base_dir,
-    )
 
     candidate_values = raw.get("tools_root_candidates")
     if not candidate_values:
@@ -84,7 +79,6 @@ def load_config(config_path: Path) -> WorkspaceConfig:
         series_root=series_root,
         socket_root=socket_root,
         token_path=token_path,
-        legacy_token_path=legacy_token_path,
         tools_root_candidates=tools_root_candidates,
         tools_root=tools_root,
         defaults=defaults,
@@ -256,16 +250,6 @@ def server_info_from_url(config: WorkspaceConfig, remote_url: str) -> dict | Non
     }
 
 
-def migrate_legacy_token_store(config: WorkspaceConfig) -> None:
-    if config.token_path.exists() or not config.legacy_token_path.exists():
-        return
-
-    config.token_path.parent.mkdir(parents=True, exist_ok=True)
-    os.chmod(config.token_path.parent, 0o700)
-    config.legacy_token_path.replace(config.token_path)
-    os.chmod(config.token_path, 0o600)
-
-
 def empty_token_store() -> dict:
     return {"version": 2, "servers": {}}
 
@@ -354,8 +338,6 @@ def normalize_token_store(config: WorkspaceConfig, raw_data: dict) -> dict:
 
 
 def load_token_store(config: WorkspaceConfig) -> dict:
-    migrate_legacy_token_store(config)
-
     if not config.token_path.exists():
         return empty_token_store()
 
@@ -425,7 +407,6 @@ def remote_credentials(remote_url: str) -> tuple[str, str] | None:
 def sync_tokens_from_repo(config: WorkspaceConfig, repo_path: Path) -> dict:
     repo_root = git_repo_root(repo_path)
     if repo_root is None:
-        migrate_legacy_token_store(config)
         return {
             "repo_root": None,
             "scanned": 0,
@@ -443,7 +424,6 @@ def sync_tokens_from_repo(config: WorkspaceConfig, repo_path: Path) -> dict:
             found_credentials.append((server_info, user_name, token_value))
 
     if not found_credentials:
-        migrate_legacy_token_store(config)
         return {
             "repo_root": repo_root,
             "scanned": 0,