diff --git a/frontend/supabase/migrations/20260718050000_profiles_service_role_upsert_grants.sql b/frontend/supabase/migrations/20260718050000_profiles_service_role_upsert_grants.sql
new file mode 100644
index 00000000..3e44d20b
--- /dev/null
+++ b/frontend/supabase/migrations/20260718050000_profiles_service_role_upsert_grants.sql
@@ -0,0 +1,53 @@
+begin;
+
+grant select, insert, update on table public.profiles to service_role;
+
+grant select (
+  id,
+  email,
+  credits,
+  created_at,
+  updated_at,
+  name,
+  birth_date,
+  birth_time,
+  country_code,
+  province_code,
+  city_code,
+  district_code,
+  latitude,
+  longitude,
+  timezone_offset
+) on public.profiles to service_role;
+
+grant insert (
+  id,
+  email,
+  name,
+  birth_date,
+  birth_time,
+  country_code,
+  province_code,
+  city_code,
+  district_code,
+  latitude,
+  longitude,
+  timezone_offset,
+  updated_at
+) on public.profiles to service_role;
+
+grant update (
+  name,
+  birth_date,
+  birth_time,
+  country_code,
+  province_code,
+  city_code,
+  district_code,
+  latitude,
+  longitude,
+  timezone_offset,
+  updated_at
+) on public.profiles to service_role;
+
+commit;
diff --git a/frontend/supabase/migrations/20260718060000_profiles_service_role_least_privilege.sql b/frontend/supabase/migrations/20260718060000_profiles_service_role_least_privilege.sql
new file mode 100644
index 00000000..d85847b5
--- /dev/null
+++ b/frontend/supabase/migrations/20260718060000_profiles_service_role_least_privilege.sql
@@ -0,0 +1,160 @@
+begin;
+
+revoke all privileges on table public.profiles from service_role;
+
+revoke select (
+  id,
+  email,
+  credits,
+  created_at,
+  updated_at,
+  name,
+  birth_date,
+  birth_time,
+  country_code,
+  province_code,
+  city_code,
+  district_code,
+  onboarding_payload,
+  onboarding_version,
+  onboarding_generated_at,
+  latitude,
+  longitude,
+  timezone_offset,
+  reported_birth_time,
+  active_birth_time,
+  birth_time_source,
+  birth_time_period,
+  birth_time_clue,
+  uncertainty_before_minutes,
+  uncertainty_after_minutes,
+  birth_time_status,
+  rectification_confidence,
+  rectification_case_id
+) on table public.profiles from service_role;
+
+revoke insert (
+  id,
+  email,
+  credits,
+  created_at,
+  updated_at,
+  name,
+  birth_date,
+  birth_time,
+  country_code,
+  province_code,
+  city_code,
+  district_code,
+  onboarding_payload,
+  onboarding_version,
+  onboarding_generated_at,
+  latitude,
+  longitude,
+  timezone_offset,
+  reported_birth_time,
+  active_birth_time,
+  birth_time_source,
+  birth_time_period,
+  birth_time_clue,
+  uncertainty_before_minutes,
+  uncertainty_after_minutes,
+  birth_time_status,
+  rectification_confidence,
+  rectification_case_id
+) on table public.profiles from service_role;
+
+revoke update (
+  id,
+  email,
+  credits,
+  created_at,
+  updated_at,
+  name,
+  birth_date,
+  birth_time,
+  country_code,
+  province_code,
+  city_code,
+  district_code,
+  onboarding_payload,
+  onboarding_version,
+  onboarding_generated_at,
+  latitude,
+  longitude,
+  timezone_offset,
+  reported_birth_time,
+  active_birth_time,
+  birth_time_source,
+  birth_time_period,
+  birth_time_clue,
+  uncertainty_before_minutes,
+  uncertainty_after_minutes,
+  birth_time_status,
+  rectification_confidence,
+  rectification_case_id
+) on table public.profiles from service_role;
+
+grant select (
+  id,
+  name,
+  birth_date,
+  birth_time,
+  country_code,
+  province_code,
+  city_code,
+  latitude,
+  longitude,
+  timezone_offset,
+  active_birth_time,
+  birth_time_status,
+  onboarding_payload,
+  onboarding_version,
+  onboarding_generated_at,
+  rectification_case_id
+) on table public.profiles to service_role;
+
+grant insert (
+  id,
+  email,
+  name,
+  birth_date,
+  birth_time,
+  country_code,
+  province_code,
+  city_code,
+  district_code,
+  latitude,
+  longitude,
+  timezone_offset,
+  updated_at
+) on table public.profiles to service_role;
+
+grant update (
+  name,
+  birth_date,
+  birth_time,
+  country_code,
+  province_code,
+  city_code,
+  district_code,
+  latitude,
+  longitude,
+  timezone_offset,
+  updated_at,
+  onboarding_payload,
+  onboarding_version,
+  onboarding_generated_at,
+  reported_birth_time,
+  active_birth_time,
+  birth_time_source,
+  birth_time_period,
+  birth_time_clue,
+  uncertainty_before_minutes,
+  uncertainty_after_minutes,
+  birth_time_status,
+  rectification_confidence,
+  rectification_case_id
+) on table public.profiles to service_role;
+
+commit;
diff --git a/frontend/supabase/migrations/20260718070000_profiles_service_role_upsert_id.sql b/frontend/supabase/migrations/20260718070000_profiles_service_role_upsert_id.sql
new file mode 100644
index 00000000..793fa7bc
--- /dev/null
+++ b/frontend/supabase/migrations/20260718070000_profiles_service_role_upsert_id.sql
@@ -0,0 +1,9 @@
+begin;
+
+-- PostgREST upsert on an existing profile updates the conflict key column
+-- even when the submitted id is unchanged. Keep this grant scoped to id so
+-- the service role can perform current /api/account upserts without restoring
+-- table-wide profile update privileges.
+grant update (id) on table public.profiles to service_role;
+
+commit;