diff --git a/openupgrade_scripts/scripts/web_tour/18.0.1.0/end-migration.py b/openupgrade_scripts/scripts/web_tour/18.0.1.0/end-migration.py
index e2f42aa290ce..238e28840ae8 100644
--- a/openupgrade_scripts/scripts/web_tour/18.0.1.0/end-migration.py
+++ b/openupgrade_scripts/scripts/web_tour/18.0.1.0/end-migration.py
@@ -4,7 +4,8 @@
 @openupgrade.migrate()
 def migrate(env, version=None):
     """
-    Set consumed tours from legacy table after migration
+    Set consumed tours from legacy table after migration and remove
+    obsolete security rules
     """
     openupgrade.logged_query(
         env.cr,
@@ -19,3 +20,19 @@ def migrate(env, version=None):
         ON CONFLICT DO NOTHING
         """,
     )
+    # web_tour.tour lost its user_id field in 18.0: any pre-existing
+    # per-user record rule (e.g. "own tours", domain [('user_id','=',
+    # user.id)]) now references a nonexistent field. Tours are loaded at
+    # every web login, so the stale rule blocks ALL logins right after
+    # the migration. Drop such rules here, where the module's own data
+    # is already reloaded.
+    openupgrade.logged_query(
+        env.cr,
+        """
+        DELETE FROM ir_rule
+        WHERE model_id = (
+            SELECT id FROM ir_model WHERE model = 'web_tour.tour'
+        )
+        AND domain_force LIKE '%user_id%'
+        """,
+    )