diff --git a/frontend/supabase/migrations/20260721100000_chat_sessions_delete_grant.sql b/frontend/supabase/migrations/20260721100000_chat_sessions_delete_grant.sql
index bb7aad04..d20a4dfd 100644
--- a/frontend/supabase/migrations/20260721100000_chat_sessions_delete_grant.sql
+++ b/frontend/supabase/migrations/20260721100000_chat_sessions_delete_grant.sql
@@ -1,5 +1,12 @@
 begin;
 
+drop policy if exists chat_sessions_delete_own on public.chat_sessions;
+create policy chat_sessions_delete_own
+  on public.chat_sessions
+  for delete
+  to authenticated
+  using ((select auth.uid()) = user_id);
+
 grant delete on table public.chat_sessions to authenticated;
 
 commit;
diff --git a/tests/test_session_management_entrypoints.py b/tests/test_session_management_entrypoints.py
index 9cd2b2d2..7efdb1ba 100644
--- a/tests/test_session_management_entrypoints.py
+++ b/tests/test_session_management_entrypoints.py
@@ -45,3 +45,5 @@ def test_chat_session_delete_is_server_controlled_and_granted() -> None:
     assert '.eq("user_id", user.id)' in route
     assert 'count !== 1' in route
     assert 'grant delete on table public.chat_sessions to authenticated' in migration.lower()
+    assert 'create policy chat_sessions_delete_own' in migration.lower()
+    assert 'using ((select auth.uid()) = user_id)' in migration.lower()