diff --git a/app/app.go b/app/app.go
index 1ac1367c4..e99444731 100644
--- a/app/app.go
+++ b/app/app.go
@@ -477,18 +477,14 @@ func (app *AxelarApp) setUpgradeBehaviour(configurator module.Configurator, keep
 	upgradeKeeper.SetUpgradeHandler(
 		upgradeName(app.Version()),
 		func(ctx sdk.Context, _ upgradetypes.Plan, fromVM module.VersionMap) (module.VersionMap, error) {
-			updatedVM, err := app.mm.RunMigrations(ctx, configurator, fromVM)
+			err := MigratePreInitializedModuleAccounts(ctx, *GetKeeper[authkeeper.AccountKeeper](keepers), []string{nexusTypes.ModuleName})
 			if err != nil {
-				return updatedVM, err
+				return nil, err
 			}
 
-			// TODO: remove after v35 upgrade
-			// Override wasm module default params
-			if upgradeName(app.Version()) == "v0.35" && IsWasmEnabled() {
-				GetKeeper[wasm.Keeper](keepers).SetParams(ctx, wasmtypes.Params{
-					CodeUploadAccess:             wasmtypes.AllowNobody,
-					InstantiateDefaultPermission: wasmtypes.AccessTypeNobody,
-				})
+			updatedVM, err := app.mm.RunMigrations(ctx, configurator, fromVM)
+			if err != nil {
+				return updatedVM, err
 			}
 
 			return updatedVM, err
diff --git a/app/migrate_module_account.go b/app/migrate_module_account.go
new file mode 100644
index 000000000..eff328479
--- /dev/null
+++ b/app/migrate_module_account.go
@@ -0,0 +1,66 @@
+package app
+
+import (
+	"fmt"
+
+	sdk "github.com/cosmos/cosmos-sdk/types"
+	authkeeper "github.com/cosmos/cosmos-sdk/x/auth/keeper"
+	authtypes "github.com/cosmos/cosmos-sdk/x/auth/types"
+)
+
+// MigratePreInitializedModuleAccounts migrates module accounts that were pre-initialized as BaseAccounts to ModuleAccounts.
+func MigratePreInitializedModuleAccounts(
+	ctx sdk.Context,
+	ak authkeeper.AccountKeeper,
+	moduleAccountsToInitialize []string,
+) error {
+	for _, module := range moduleAccountsToInitialize {
+		addr, perms := ak.GetModuleAddressAndPermissions(module)
+		if addr == nil {
+			return fmt.Errorf(
+				"failed to get module address and permissions for module %s",
+				module,
+			)
+		}
+
+		acc := ak.GetAccount(ctx, addr)
+		if acc == nil {
+			ctx.Logger().Info(fmt.Sprintf(
+				"account for module %s has not been initialized yet, skipping",
+				module,
+			))
+			continue
+		}
+
+		_, isModuleAccount := acc.(authtypes.ModuleAccountI)
+		if isModuleAccount {
+			ctx.Logger().Info(fmt.Sprintf(
+				"account for module %s was correctly initialized, skipping",
+				module,
+			))
+			continue
+		}
+
+		// Migrate from base account to module account
+		baseAccount, ok := acc.(*authtypes.BaseAccount)
+		if !ok {
+			panic(fmt.Sprintf("account %s must be a base account", acc.GetAddress()))
+		}
+
+		newModuleAccount := authtypes.NewModuleAccount(
+			baseAccount,
+			module,
+			perms...,
+		)
+		ak.SetModuleAccount(ctx, newModuleAccount)
+
+		ctx.Logger().Info(fmt.Sprintf(
+			"Successfully migrated from base account %+v to module account %+v for module %s",
+			baseAccount,
+			newModuleAccount,
+			module,
+		))
+	}
+
+	return nil
+}