diff --git a/files/usr/bin/parahub-heartbeat b/files/usr/bin/parahub-heartbeat
index c5641c0..135461a 100755
--- a/files/usr/bin/parahub-heartbeat
+++ b/files/usr/bin/parahub-heartbeat
@@ -19,6 +19,14 @@ UPTIME="$(cut -d. -f1 /proc/uptime)"
 MESH_IP=$(ip -4 addr show br-private 2>/dev/null | grep -o 'inet [0-9.]*' | cut -d' ' -f2)
 MESH_IP="${MESH_IP:-unknown}"
 
+# Generate WireGuard VPS keypair if missing (OTA from pre-VPS firmware)
+if [ "$ROLE" != "bee" ] && [ ! -f /etc/parahub/wg_vps_private.key ] && command -v wg >/dev/null 2>&1; then
+    umask 077
+    wg genkey > /etc/parahub/wg_vps_private.key
+    wg pubkey < /etc/parahub/wg_vps_private.key > /etc/parahub/wg_vps_public.key
+    logger -t parahub-heartbeat "Generated VPS WireGuard keypair (OTA migration)"
+fi
+
 # Read WireGuard VPS public key (Bumblebee only)
 WG_PUBKEY=""
 if [ -f /etc/parahub/wg_vps_public.key ]; then