diff --git a/config/initializers/legacy_otp_secret.rb b/app/models/concerns/legacy_otp_secret.rb
similarity index 96%
rename from config/initializers/legacy_otp_secret.rb
rename to app/models/concerns/legacy_otp_secret.rb
index 957b99f024c..466c4ec9bb3 100644
--- a/config/initializers/legacy_otp_secret.rb
+++ b/app/models/concerns/legacy_otp_secret.rb
@@ -1,14 +1,13 @@
 # frozen_string_literal: true
 
 # TODO: This file is here for legacy support during devise-two-factor upgrade.
-# It should be removed after all records have been migrated to the new approach.
+# It should be removed after all records have been migrated.
 
-class User
-  # ...
+module LegacyOtpSecret
+  extend ActiveSupport::Concern
 
   private
 
-  ##
   # Decrypt and return the `encrypted_otp_secret` attribute which was used in
   # prior versions of devise-two-factor
   # @return [String] The decrypted OTP secret
diff --git a/app/models/user.rb b/app/models/user.rb
index 584120cf2eb..5d68b567ecd 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -54,6 +54,7 @@ class User < ApplicationRecord
   )
 
   include LanguagesHelper
+  include LegacyOtpSecret
   include Redisable
   include User::HasSettings
   include User::LdapAuthenticable