diff --git a/app/src/main/java/com/tangem/tap/domain/userWalletList/repository/DefaultUserWalletsListRepository.kt b/app/src/main/java/com/tangem/tap/domain/userWalletList/repository/DefaultUserWalletsListRepository.kt
index 7532173467..b68196f43b 100644
--- a/app/src/main/java/com/tangem/tap/domain/userWalletList/repository/DefaultUserWalletsListRepository.kt
+++ b/app/src/main/java/com/tangem/tap/domain/userWalletList/repository/DefaultUserWalletsListRepository.kt
@@ -375,6 +375,13 @@ internal class DefaultUserWalletsListRepository(
             oldUserWallet is UserWallet.Hot && newUserWallet is UserWallet.Cold
         ) {
             removeHotWalletsFromSDK(walletIds = listOf(oldUserWallet.walletId))
+            // When upgrading from Hot to Cold, if biometric lock is available, set it
+            if (hasBiometry()) {
+                setLock(newUserWallet.walletId, LockMethod.Biometric, changeUnsecured = true)
+            }
+            // Remove any encryption keys related to the old hot wallet
+            userWalletEncryptionKeysRepository.removeEncryptedWithPasswordKey(oldUserWallet.walletId)
+            userWalletEncryptionKeysRepository.removeUnsecuredKey(oldUserWallet.walletId)
         }
     }
 
diff --git a/app/src/main/java/com/tangem/tap/domain/userWalletList/repository/UserWalletEncryptionKeysRepository.kt b/app/src/main/java/com/tangem/tap/domain/userWalletList/repository/UserWalletEncryptionKeysRepository.kt
index faf5553d90..e64db24760 100644
--- a/app/src/main/java/com/tangem/tap/domain/userWalletList/repository/UserWalletEncryptionKeysRepository.kt
+++ b/app/src/main/java/com/tangem/tap/domain/userWalletList/repository/UserWalletEncryptionKeysRepository.kt
@@ -66,6 +66,14 @@ internal class UserWalletEncryptionKeysRepository(
         authenticatedStorage.delete(StorageKey.UserWalletEncryptionKey(userWalletId).name)
     }
 
+    fun removeEncryptedWithPasswordKey(userWalletId: UserWalletId) {
+        secureStorage.delete(StorageKey.UserWalletEncryptionKeyEncrypted(userWalletId).name)
+    }
+
+    fun removeUnsecuredKey(userWalletId: UserWalletId) {
+        secureStorage.delete(StorageKey.UserWalletEncryptionKeyUnsecured(userWalletId).name)
+    }
+
     suspend fun getAllUnsecured(): List<UserWalletEncryptionKey> = withContext(dispatchers.io) {
         getUserWalletsIds().mapNotNull { userWalletId ->
             secureStorage.get(account = StorageKey.UserWalletEncryptionKeyUnsecured(userWalletId).name).decodeToKey()