diff --git a/alembic/versions/0085_restore_tenant_rls.py b/alembic/versions/0085_restore_tenant_rls.py
index 232135d..b678a08 100644
--- a/alembic/versions/0085_restore_tenant_rls.py
+++ b/alembic/versions/0085_restore_tenant_rls.py
@@ -114,8 +114,10 @@ def upgrade() -> None:
         _exec(f"REVOKE ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public FROM {role}")
         _exec(f"REVOKE ALL PRIVILEGES ON SCHEMA public FROM {role}")
 
-    # Step 5: Drop crm_runtime role (may fail if permissions insufficient)
-    _exec("DO $$ BEGIN DROP ROLE IF EXISTS crm_runtime; EXCEPTION WHEN insufficient_privilege THEN NULL; END $$")
+    # Step 5: Drop crm_runtime role — revoke default privileges first, then drop
+    _exec("ALTER DEFAULT PRIVILEGES IN SCHEMA public REVOKE SELECT, INSERT, UPDATE, DELETE ON TABLES FROM crm_runtime")
+    _exec("ALTER DEFAULT PRIVILEGES IN SCHEMA public REVOKE USAGE, SELECT ON SEQUENCES FROM crm_runtime")
+    _exec("DO $$ BEGIN DROP ROLE IF EXISTS crm_runtime; EXCEPTION WHEN insufficient_privilege THEN NULL; WHEN dependent_objects_still_exist THEN NULL; END $$")
 
     # Step 6: Grant schema USAGE to runtime roles
     _exec("GRANT USAGE ON SCHEMA public TO crm_api")