Laravel Jetstream Fortify and Legacy Laravel Auth Interoperability During Zero-Downtime Migration

An established Laravel application needs to adopt Laravel Jetstream’s Fortify authentication backend while remaining continuously available, preserving active user sessions, and accepting existing password hashes until users are migrated.

During the transition, legacy authentication routes and Jetstream/Fortify routes must operate concurrently, but the documentation does not define a supported pattern for routing requests between the two systems based on user migration status. Session continuity is complicated because Fortify issues its own encrypted cookies, and the interaction between the existing session store and Fortify’s session handling is not documented for incremental adoption.

Password compatibility introduces further uncertainty: Fortify defaults to bcrypt, while the current application may rely on a different hashing driver or custom user provider. The boundary between legacy password verification and Fortify’s rehashing behavior during login is unclear when both systems must validate credentials for different user cohorts.

Which session handoff strategy preserves encrypted cookies across the legacy-to-Fortify boundary without forcing reauthentication, and how should password hashing be configured so migrated users rehash on login while unmigrated users continue to authenticate against the legacy provider?