diff --git a/awx/main/migrations/0041_v320_drop_v1_credential_fields.py b/awx/main/migrations/0041_v320_drop_v1_credential_fields.py
index c83f540349..213e772031 100644
--- a/awx/main/migrations/0041_v320_drop_v1_credential_fields.py
+++ b/awx/main/migrations/0041_v320_drop_v1_credential_fields.py
@@ -1,7 +1,7 @@
 # -*- coding: utf-8 -*-
 from __future__ import unicode_literals
 
-from django.db import migrations
+from django.db import migrations, models
 
 
 class Migration(migrations.Migration):
@@ -95,4 +95,9 @@ class Migration(migrations.Migration):
             name='credentialtype',
             unique_together=set([('name', 'kind')]),
         ),
+        migrations.AlterField(
+            model_name='credential',
+            name='credential_type',
+            field=models.ForeignKey(related_name='credentials', to='main.CredentialType', null=False)
+        )
     ]
diff --git a/awx/main/migrations/_credentialtypes.py b/awx/main/migrations/_credentialtypes.py
index 6f40680462..b387f33fd1 100644
--- a/awx/main/migrations/_credentialtypes.py
+++ b/awx/main/migrations/_credentialtypes.py
@@ -1,5 +1,4 @@
-import mock
-
+from awx.main import utils
 from awx.main.models import CredentialType
 from awx.main.utils.common import encrypt_field, decrypt_field
 
@@ -7,11 +6,12 @@ from awx.main.utils.common import encrypt_field, decrypt_field
 def migrate_to_v2_credentials(apps, schema_editor):
     CredentialType.setup_tower_managed_defaults()
 
-    # this mock is necessary to make the implicit role generation save signal
-    # use the correct Role model (the version active at this point in
+    # this monkey-patch is necessary to make the implicit role generation save
+    # signal use the correct Role model (the version active at this point in
     # migration, not the one at HEAD)
-    with mock.patch('awx.main.utils.get_current_apps', lambda: apps):
-
+    orig_current_apps = utils.get_current_apps
+    try:
+        utils.get_current_apps = lambda: apps
         for cred in apps.get_model('main', 'Credential').objects.all():
             data = {}
             if getattr(cred, 'vault_password', None):
@@ -60,6 +60,8 @@ def migrate_to_v2_credentials(apps, schema_editor):
                                 setattr(new_cred, field, value)
                                 new_cred.inputs[field] = encrypt_field(new_cred, field)
                                 setattr(new_cred, field, '')
-                        else:
+                        elif getattr(cred, field):
                             new_cred.inputs[field] = getattr(cred, field)
                     new_cred.save()
+    finally:
+        utils.get_current_apps = orig_current_apps
diff --git a/awx/main/models/credential.py b/awx/main/models/credential.py
index ec587c4c50..7303465bce 100644
--- a/awx/main/models/credential.py
+++ b/awx/main/models/credential.py
@@ -234,6 +234,7 @@ class Credential(PasswordFieldsModel, CommonModelNameNotUnique, ResourceMixin):
     credential_type = models.ForeignKey(
         'CredentialType',
         related_name='credentials',
+        null=False,
         help_text=_('Type for this credential.  Credential Types define '
                     'valid fields (e.g,. "username", "password") and their '
                     'properties (e.g,. "username is required" or "password '