diff --git a/k8s/data/schemas/db-permissions-job.yaml b/k8s/data/schemas/db-permissions-job.yaml
new file mode 100644
index 0000000..5ad6c05
--- /dev/null
+++ b/k8s/data/schemas/db-permissions-job.yaml
@@ -0,0 +1,99 @@
+# PostSync Job to grant schema permissions after Database CRs reconcile
+# CNPG Database CR creates DBs but doesn't set schema permissions correctly
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: db-permissions
+  namespace: ddb
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: db-permissions
+  namespace: ddb
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: db-permissions
+  namespace: ddb
+subjects:
+  - kind: ServiceAccount
+    name: db-permissions
+    namespace: ddb
+roleRef:
+  kind: Role
+  name: db-permissions
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: db-permissions
+  namespace: ddb
+  annotations:
+    argocd.argoproj.io/hook: PostSync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
+spec:
+  backoffLimit: 5
+  template:
+    spec:
+      serviceAccountName: db-permissions
+      restartPolicy: Never
+      containers:
+      - name: grant-permissions
+        image: postgres:16-alpine
+        command:
+        - /bin/sh
+        - -c
+        - |
+          set -e
+          
+          echo "Granting schema permissions to app users..."
+          
+          # Get postgres password
+          export PGPASSWORD=$(cat /postgres-secret/password)
+          
+          # Grant for authentik
+          psql -h ddb-cluster-rw -U postgres -d authentik << 'SQL'
+          GRANT ALL ON SCHEMA public TO app;
+          GRANT ALL ON SCHEMA public TO authentik;
+          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO app;
+          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO app;
+          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO authentik;
+          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO authentik;
+          SQL
+          
+          # Grant for temporal
+          psql -h ddb-cluster-rw -U postgres -d temporal << 'SQL'
+          GRANT ALL ON SCHEMA public TO app;
+          GRANT ALL ON SCHEMA public TO temporal;
+          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO app;
+          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO app;
+          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO temporal;
+          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO temporal;
+          SQL
+          
+          # Grant for temporal_visibility
+          psql -h ddb-cluster-rw -U postgres -d temporal_visibility << 'SQL'
+          GRANT ALL ON SCHEMA public TO app;
+          GRANT ALL ON SCHEMA public TO temporal;
+          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO app;
+          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO app;
+          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO temporal;
+          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO temporal;
+          SQL
+          
+          echo "Permissions granted successfully"
+        volumeMounts:
+        - name: postgres-secret
+          mountPath: /postgres-secret
+          readOnly: true
+      volumes:
+      - name: postgres-secret
+        secret:
+          secretName: ddb-cluster-superuser
diff --git a/k8s/data/schemas/kustomization.yaml b/k8s/data/schemas/kustomization.yaml
index 415fabf..f3b1d14 100644
--- a/k8s/data/schemas/kustomization.yaml
+++ b/k8s/data/schemas/kustomization.yaml
@@ -8,6 +8,7 @@ namespace: ddb
 # GitOps-managed database schemas (ArgoCD wave 6).
 # These depend on ddb-cluster existing (bootstrap wave 0).
 resources:
+  - db-permissions-job.yaml
   - authentik-database.yaml
   - temporal-database.yaml
   - temporal-visibility-database.yaml