diff --git a/prestart.sh b/prestart.sh
index e070375..1cca4bb 100644
--- a/prestart.sh
+++ b/prestart.sh
@@ -31,7 +31,7 @@ echo "[prestart] DB migrations completed successfully."
 # Migration 0070 creates these roles without passwords; we set them here so the
 # API/Worker/Auth connections can authenticate.
 echo "[prestart] Setting DB role passwords..."
-python3 -c "
+cat > /tmp/set_role_passwords.py << 'PYEOF'
 import asyncio
 import os
 import re
@@ -43,7 +43,6 @@ async def set_passwords():
     if not db_url:
         print('[prestart] WARNING: No DB URL for password setup')
         return
-    # Extract password from the DB URL (postgresql+asyncpg://user:pass@host:port/db)
     match = re.search(r'://([^:]+):([^@]+)@', db_url)
     if not match:
         print('[prestart] WARNING: Could not extract password from DB URL')
@@ -55,9 +54,7 @@ async def set_passwords():
         async with engine.begin() as conn:
             for role in roles:
                 try:
-                    # ALTER ROLE doesn't support prepared statement parameters
-                    # so we inline the password (extracted from DB URL, safe)
-                    await conn.execute(text("ALTER ROLE " + role + " WITH LOGIN PASSWORD '" + pwd + "'"))
+                    await conn.execute(text(f"ALTER ROLE {role} WITH LOGIN PASSWORD '{pwd}'"))
                     print(f'[prestart] Password set for {role}')
                 except Exception as e:
                     print(f'[prestart] WARNING: Could not set password for {role}: {e}')
@@ -68,7 +65,9 @@ async def set_passwords():
         await engine.dispose()
 
 asyncio.run(set_passwords())
-"
+PYEOF
+python3 /tmp/set_role_passwords.py
+rm -f /tmp/set_role_passwords.py
 
 # Set crm_runtime password if RUNTIME_DB_PASSWORD is set (legacy support)
 if [ -n "$RUNTIME_DB_PASSWORD" ]; then