diff --git a/cmd/incus-migrate/main_migrate.go b/cmd/incus-migrate/main_migrate.go
index e716a2424ce..43aa37967d3 100644
--- a/cmd/incus-migrate/main_migrate.go
+++ b/cmd/incus-migrate/main_migrate.go
@@ -113,6 +113,19 @@ func (c *cmdMigrateData) Render() string {
 }
 
 func (c *cmdMigrate) askServer() (incus.InstanceServer, string, error) {
+	// Detect local server.
+	local, err := c.connectLocal()
+	if err == nil {
+		useLocal, err := c.global.asker.AskBool("The local Incus server is the target [default=yes]: ", "yes")
+		if err != nil {
+			return nil, "", err
+		}
+
+		if useLocal {
+			return local, "", nil
+		}
+	}
+
 	// Server address
 	serverURL, err := c.global.asker.AskString("Please provide Incus server URL: ", "", nil)
 	if err != nil {
@@ -339,12 +352,22 @@ func (c *cmdMigrate) RunInteractive(server incus.InstanceServer) (cmdMigrateData
 		architectureName, _ := osarch.ArchitectureGetLocal()
 
 		if slices.Contains([]string{"x86_64", "aarch64"}, architectureName) {
-			hasSecureBoot, err := c.global.asker.AskBool("Does the VM support UEFI Secure Boot? [default=no]: ", "no")
+			hasUEFI, err := c.global.asker.AskBool("Does the VM support UEFI booting? [default=yes]: ", "yes")
 			if err != nil {
 				return cmdMigrateData{}, err
 			}
 
-			if !hasSecureBoot {
+			if hasUEFI {
+				hasSecureBoot, err := c.global.asker.AskBool("Does the VM support UEFI Secure Boot? [default=yes]: ", "yes")
+				if err != nil {
+					return cmdMigrateData{}, err
+				}
+
+				if !hasSecureBoot {
+					config.InstanceArgs.Config["security.secureboot"] = "false"
+				}
+			} else {
+				config.InstanceArgs.Config["security.csm"] = "true"
 				config.InstanceArgs.Config["security.secureboot"] = "false"
 			}
 		}
diff --git a/cmd/incus-migrate/utils.go b/cmd/incus-migrate/utils.go
index e9936189046..c1148122253 100644
--- a/cmd/incus-migrate/utils.go
+++ b/cmd/incus-migrate/utils.go
@@ -143,6 +143,13 @@ func transferRootfs(ctx context.Context, dst incus.InstanceServer, op incus.Oper
 	return nil
 }
 
+func (m *cmdMigrate) connectLocal() (incus.InstanceServer, error) {
+	args := incus.ConnectionArgs{}
+	args.UserAgent = fmt.Sprintf("LXC-MIGRATE %s", version.Version)
+
+	return incus.ConnectIncusUnix("", &args)
+}
+
 func (m *cmdMigrate) connectTarget(url string, certPath string, keyPath string, authType string, token string) (incus.InstanceServer, string, error) {
 	args := incus.ConnectionArgs{
 		AuthType: authType,
diff --git a/internal/server/storage/backend.go b/internal/server/storage/backend.go
index f8fe7f15b00..549ce342ae4 100644
--- a/internal/server/storage/backend.go
+++ b/internal/server/storage/backend.go
@@ -7107,6 +7107,16 @@ func (b *backend) CreateCustomVolumeFromBackup(srcBackup backup.Info, srcData io
 
 	vol := b.GetVolume(drivers.VolumeTypeCustom, drivers.ContentType(srcBackup.Config.Volume.ContentType), volStorageName, srcBackup.Config.Volume.Config)
 
+	// Check if the volume exists in database.
+	dbVol, err := VolumeDBGet(b, srcBackup.Project, srcBackup.Name, vol.Type())
+	if err != nil && !response.IsNotFoundError(err) {
+		return err
+	}
+
+	if dbVol != nil {
+		return fmt.Errorf("Volume %q already exists in pool %q", srcBackup.Name, b.name)
+	}
+
 	// Validate config and create database entry for new storage volume.
 	// Strip unsupported config keys (in case the export was made from a different type of storage pool).
 	err = VolumeDBCreate(b, srcBackup.Project, srcBackup.Name, srcBackup.Config.Volume.Description, vol.Type(), false, vol.Config(), srcBackup.Config.Volume.CreatedAt, time.Time{}, vol.ContentType(), true, true)