diff --git a/alembic/versions/0106_grant_notification_types_permissions.py b/alembic/versions/0106_grant_notification_types_permissions.py
new file mode 100644
index 0000000..8d9fc13
--- /dev/null
+++ b/alembic/versions/0106_grant_notification_types_permissions.py
@@ -0,0 +1,26 @@
+"""Grant DELETE permission on notification_types to app DB roles.
+
+The unified_search plugin activation calls sync_notification_types() which
+DELETEs stale rows from notification_types. The app DB user (crm_api) lacks
+DELETE permission on this table, causing plugin activation to fail with
+InsufficientPrivilegeError.
+
+Revision ID: 0106
+"""
+
+from alembic import op
+import sqlalchemy as sa
+
+revision = "0106"
+down_revision = "0105"
+
+
+def upgrade() -> None:
+    # Grant all necessary permissions on notification_types to app roles
+    for role in ["crm_api", "crm_auth", "crm_worker"]:
+        op.execute(f"GRANT SELECT, INSERT, UPDATE, DELETE ON notification_types TO {role}")
+
+
+def downgrade() -> None:
+    for role in ["crm_api", "crm_auth", "crm_worker"]:
+        op.execute(f"REVOKE DELETE ON notification_types FROM {role}")