diff --git a/alembic/versions/0015_rls_policies.py b/alembic/versions/0015_rls_policies.py
index d83335b..98be3b9 100644
--- a/alembic/versions/0015_rls_policies.py
+++ b/alembic/versions/0015_rls_policies.py
@@ -1,5 +1,7 @@
 """Enable Row Level Security with tenant isolation policies on core tables.
 
+Idempotent: drops existing policies before creating them.
+
 Revision ID: 0015_rls_policies
 Revises: 0014_currency_unique_fix
 Create Date: 2026-07-04
@@ -41,15 +43,15 @@ RLS_TABLES = [
     "password_reset_tokens",
 ]
 
-# Tables without tenant_id — no RLS (plugins, plugin_migrations are global)
-NO_RLS_TABLES = ["plugins", "plugin_migrations"]
-
 
 def upgrade() -> None:
     for table_name in RLS_TABLES:
-        # Enable RLS on the table
+        # Enable RLS on the table (idempotent — ENABLE is safe to repeat)
         op.execute(f"ALTER TABLE {table_name} ENABLE ROW LEVEL SECURITY")
 
+        # Drop existing policy if it exists (idempotent — prevents DuplicateObjectError on restart)
+        op.execute(f"DROP POLICY IF EXISTS tenant_isolation ON {table_name}")
+
         # Create tenant isolation policy
         # USING clause: tenant_id must match the session variable set by the app
         op.execute(