diff --git a/alembic/versions/0085_restore_tenant_rls.py b/alembic/versions/0085_restore_tenant_rls.py
index 5fad194..5c6cd27 100644
--- a/alembic/versions/0085_restore_tenant_rls.py
+++ b/alembic/versions/0085_restore_tenant_rls.py
@@ -77,6 +77,8 @@ AUTH_TABLES = {
     "user_tenants": ["SELECT"],
     "tenants": ["SELECT"],
     "password_reset_tokens": ["SELECT", "INSERT", "UPDATE", "DELETE"],
+    "sessions": ["SELECT", "INSERT", "UPDATE", "DELETE"],
+    "audit_log": ["SELECT", "INSERT"],
 }
 
 WORKER_GLOBAL_TABLES = {
diff --git a/app/services/auth_service.py b/app/services/auth_service.py
index 330b0b8..be5c19e 100644
--- a/app/services/auth_service.py
+++ b/app/services/auth_service.py
@@ -109,6 +109,10 @@ class AuthService:
             db, redis, user, tenant.id, role=user_tenant.role
         )
 
+        # Set tenant context for audit log write (auth session uses crm_auth role)
+        from app.core.db import set_tenant_context
+        await set_tenant_context(db, tenant.id)
+
         # Log the login in audit trail
         await log_audit(
             db,