diff --git a/src/mt_odoo_mcp/auth/service.py b/src/mt_odoo_mcp/auth/service.py
index 7394596..7f865ab 100644
--- a/src/mt_odoo_mcp/auth/service.py
+++ b/src/mt_odoo_mcp/auth/service.py
@@ -97,12 +97,20 @@ def get_user_by_api_key(api_key: str) -> Optional[User]:
 
 
 def regenerate_api_key(user_id: int) -> str:
-    """Generate a new API key for the user. Returns the full key (shown once)."""
+    """Generate a new API key for the user. Returns the full key (shown once).
+
+    Also syncs the backfilled 'Default (legacy)' row in api_keys (see
+    list_api_keys) if one exists, so the Tokens page doesn't show a stale
+    prefix/hash for a key that no longer works after rotation."""
     full_key, key_hash, key_prefix = generate_api_key()
     db_execute(
         "UPDATE users SET api_key_hash = ?, api_key_prefix = ? WHERE id = ?",
         (key_hash, key_prefix, user_id),
     )
+    db_execute(
+        "UPDATE api_keys SET key_hash = ?, key_prefix = ? WHERE user_id = ? AND name = 'Default (legacy)'",
+        (key_hash, key_prefix, user_id),
+    )
     db_commit()
     return full_key