diff --git a/k8s/data/schemas/db-permissions-job.yaml b/k8s/data/schemas/db-permissions-job.yaml
index 5ad6c05..f4fc119 100644
--- a/k8s/data/schemas/db-permissions-job.yaml
+++ b/k8s/data/schemas/db-permissions-job.yaml
@@ -55,11 +55,11 @@ spec:
           
           echo "Granting schema permissions to app users..."
           
-          # Get postgres password
+          # Get app user password
           export PGPASSWORD=$(cat /postgres-secret/password)
           
-          # Grant for authentik
-          psql -h ddb-cluster-rw -U postgres -d authentik << 'SQL'
+          # Grant for authentik (as app user, owner of the DB)
+          psql -h ddb-cluster-rw -U app -d authentik << 'SQL'
           GRANT ALL ON SCHEMA public TO app;
           GRANT ALL ON SCHEMA public TO authentik;
           ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO app;
@@ -69,7 +69,7 @@ spec:
           SQL
           
           # Grant for temporal
-          psql -h ddb-cluster-rw -U postgres -d temporal << 'SQL'
+          psql -h ddb-cluster-rw -U app -d temporal << 'SQL'
           GRANT ALL ON SCHEMA public TO app;
           GRANT ALL ON SCHEMA public TO temporal;
           ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO app;
@@ -79,7 +79,7 @@ spec:
           SQL
           
           # Grant for temporal_visibility
-          psql -h ddb-cluster-rw -U postgres -d temporal_visibility << 'SQL'
+          psql -h ddb-cluster-rw -U app -d temporal_visibility << 'SQL'
           GRANT ALL ON SCHEMA public TO app;
           GRANT ALL ON SCHEMA public TO temporal;
           ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO app;
@@ -96,4 +96,4 @@ spec:
       volumes:
       - name: postgres-secret
         secret:
-          secretName: ddb-cluster-superuser
+          secretName: ddb-cluster-app