diff --git a/alembic/versions/0019_rbac_groups.py b/alembic/versions/0019_rbac_groups.py
index c57e9c5..e92a804 100644
--- a/alembic/versions/0019_rbac_groups.py
+++ b/alembic/versions/0019_rbac_groups.py
@@ -55,7 +55,7 @@ def upgrade() -> None:
     )
     op.create_index("ix_user_tenants_role_id", "user_tenants", ["role_id"])
 
-    # ── roles: add denied_permissions + permission_version ──
+    # ── roles: add denied_permissions + permission_version + missing mixin columns ──
     op.add_column(
         "roles",
         sa.Column("denied_permissions", JSONB, nullable=False, server_default="[]"),
@@ -64,6 +64,15 @@ def upgrade() -> None:
         "roles",
         sa.Column("permission_version", sa.Integer, nullable=False, server_default="1"),
     )
+    # Add missing TimestampMixin + SoftDeleteMixin columns
+    op.add_column(
+        "roles",
+        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
+    )
+    op.add_column(
+        "roles",
+        sa.Column("deleted_at", sa.DateTime(timezone=True), nullable=True),
+    )
 
     # ── Seed default roles per tenant ──
     # For each tenant, create admin/editor/viewer role records if they don't exist
@@ -123,6 +132,8 @@ def upgrade() -> None:
 
 
 def downgrade() -> None:
+    op.drop_column("roles", "deleted_at")
+    op.drop_column("roles", "updated_at")
     op.drop_column("roles", "permission_version")
     op.drop_column("roles", "denied_permissions")
     op.drop_index("ix_user_tenants_role_id", table_name="user_tenants")