diff --git a/db/migrate/20181020103501_revoke_variant_overrideswithout_permissions.rb b/db/migrate/20181020103501_revoke_variant_overrideswithout_permissions.rb
new file mode 100644
index 00000000000..bd2d0e750bc
--- /dev/null
+++ b/db/migrate/20181020103501_revoke_variant_overrideswithout_permissions.rb
@@ -0,0 +1,17 @@
+class RevokeVariantOverrideswithoutPermissions < ActiveRecord::Migration
+  def up
+    # This process was executed when the permission_revoked_at colum was created (see AddPermissionRevokedAtToVariantOverrides)
+    #   It needs to be repeated due to #2739
+    variant_override_hubs = Enterprise.where(id: VariantOverride.all.map(&:hub_id).uniq)
+
+    variant_override_hubs.each do |hub|
+      permitting_producer_ids = hub.relationships_as_child
+        .with_permission(:create_variant_overrides).map(&:parent_id)
+
+      variant_overrides_with_revoked_permissions = VariantOverride.for_hubs(hub)
+        .joins(variant: :product).where("spree_products.supplier_id NOT IN (?)", permitting_producer_ids)
+
+      variant_overrides_with_revoked_permissions.update_all(permission_revoked_at: Time.now)
+    end
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index c29fa95b9e6..3e60568a4a3 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -11,7 +11,7 @@
 #
 # It's strongly recommended to check this file into your version control system.
 
-ActiveRecord::Schema.define(:version => 20181010093850) do
+ActiveRecord::Schema.define(:version => 20181020103501) do
 
   create_table "account_invoices", :force => true do |t|
     t.integer  "user_id",    :null => false