diff --git a/db/migrate/20170820100558_correct_protected_tags_foreign_keys.rb b/db/migrate/20170820100558_correct_protected_tags_foreign_keys.rb
new file mode 100644
index 0000000000000000000000000000000000000000..229298e194636a94cccde10ffd6d683dac5d4343
--- /dev/null
+++ b/db/migrate/20170820100558_correct_protected_tags_foreign_keys.rb
@@ -0,0 +1,35 @@
+# See http://doc.gitlab.com/ce/development/migration_style_guide.html
+# for more information on how to write migrations for GitLab.
+
+class CorrectProtectedTagsForeignKeys < ActiveRecord::Migration
+  include Gitlab::Database::MigrationHelpers
+
+  # Set this constant to true if this migration requires downtime.
+  DOWNTIME = false
+
+  disable_ddl_transaction!
+
+  def up
+    remove_foreign_key_without_error(:protected_tag_create_access_levels,
+                                     column: :protected_tag_id)
+
+    execute <<-EOF
+    DELETE FROM protected_tag_create_access_levels
+    WHERE NOT EXISTS (
+      SELECT true
+      FROM protected_tags
+      WHERE protected_tag_create_access_levels.protected_tag_id = protected_tags.id
+    )
+    AND protected_tag_id IS NOT NULL
+    EOF
+
+    add_concurrent_foreign_key(:protected_tag_create_access_levels,
+                               :protected_tags,
+                               column: :protected_tag_id)
+  end
+
+  def down
+    # Previously there was a foreign key without a CASCADING DELETE, so we'll
+    # just leave the foreign key in place.
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 2ea6ae29dc7e56312fb0a5bec6e74811ab817995..80f8cde18181a4482c497b5bfb3e66ec7cdb263b 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -11,7 +11,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 20170815060945) do
+ActiveRecord::Schema.define(version: 20170820100558) do
 
   # These are extensions that must be enabled in order to support this database
   enable_extension "plpgsql"
@@ -1726,7 +1726,7 @@ ActiveRecord::Schema.define(version: 20170815060945) do
   add_foreign_key "protected_branch_push_access_levels", "protected_branches", name: "fk_9ffc86a3d9", on_delete: :cascade
   add_foreign_key "protected_branches", "projects", name: "fk_7a9c6d93e7", on_delete: :cascade
   add_foreign_key "protected_tag_create_access_levels", "namespaces", column: "group_id"
-  add_foreign_key "protected_tag_create_access_levels", "protected_tags"
+  add_foreign_key "protected_tag_create_access_levels", "protected_tags", name: "fk_f7dfda8c51", on_delete: :cascade
   add_foreign_key "protected_tag_create_access_levels", "users"
   add_foreign_key "protected_tags", "projects", name: "fk_8e4af87648", on_delete: :cascade
   add_foreign_key "push_event_payloads", "events_for_migration", column: "event_id", name: "fk_36c74129da", on_delete: :cascade
diff --git a/lib/gitlab/database/migration_helpers.rb b/lib/gitlab/database/migration_helpers.rb
index 69ca9aa596bac64da820ae4868a3f5a8047320fb..b83e633c7ed3d0d8d81d7827f7e40c15fa71719b 100644
--- a/lib/gitlab/database/migration_helpers.rb
+++ b/lib/gitlab/database/migration_helpers.rb
@@ -606,6 +606,11 @@ module Gitlab
           Arel::Nodes::SqlLiteral.new(replace.to_sql)
         end
       end
+
+      def remove_foreign_key_without_error(*args)
+        remove_foreign_key(*args)
+      rescue ArgumentError
+      end
     end
   end
 end