diff --git a/supabase/migrations/20260807000000_expand_roles.sql b/supabase/migrations/20260807000000_expand_roles.sql
new file mode 100644
index 0000000..a708364
--- /dev/null
+++ b/supabase/migrations/20260807000000_expand_roles.sql
@@ -0,0 +1,19 @@
+-- Role expansion — spec section 3.
+--
+-- This migration ONLY adds enum values. Postgres forbids using a new enum value
+-- in the same transaction that added it, and the Supabase CLI wraps each
+-- migration file in one transaction, so every use of these values must live in
+-- a later file. Do not add anything else here.
+--
+-- Existing values ('admin', 'teacher', 'parent') are kept. 'admin' is retained
+-- as the legacy organization-wide administrator so the policies written before
+-- this migration keep working unchanged; 20260807000100 teaches the role
+-- helpers that 'org_admin' and 'super_admin' also satisfy it.
+
+ALTER TYPE public.app_role ADD VALUE IF NOT EXISTS 'super_admin';
+ALTER TYPE public.app_role ADD VALUE IF NOT EXISTS 'org_admin';
+ALTER TYPE public.app_role ADD VALUE IF NOT EXISTS 'campus_admin';
+ALTER TYPE public.app_role ADD VALUE IF NOT EXISTS 'management';
+ALTER TYPE public.app_role ADD VALUE IF NOT EXISTS 'billing_admin';
+ALTER TYPE public.app_role ADD VALUE IF NOT EXISTS 'staff';
+ALTER TYPE public.app_role ADD VALUE IF NOT EXISTS 'auditor';