diff --git a/src/components/cases/documents-tab.tsx b/src/components/cases/documents-tab.tsx
index 5cbbe3c..14d0dc9 100644
--- a/src/components/cases/documents-tab.tsx
+++ b/src/components/cases/documents-tab.tsx
@@ -298,13 +298,15 @@ export function CaseDocumentsTab({ caseId }: { caseId: string }) {
 
   const deleteFolder = async (full: string) => {
     const inFolder = docs.filter((d) => (d.folder || "") === full || (d.folder || "").startsWith(`${full}/`));
-    if (inFolder.length && !confirm(`Folder "${full}" contains ${inFolder.length} file(s). Delete folder and all its files?`)) return;
-    if (!inFolder.length && !confirm(`Delete empty folder "${full}"?`)) return;
-    if (inFolder.length) {
-      await supabase.storage.from("case-documents").remove(inFolder.map((d) => d.storage_path));
-      await supabase.from("documents").delete().in("id", inFolder.map((d) => d.id));
+    const hasSubfolders = folders.some((f) => f.startsWith(`${full}/`));
+    if (inFolder.length || hasSubfolders) {
+      toast.error("Folder is not empty", {
+        description: "Move or delete its contents before deleting the folder.",
+      });
+      return;
     }
-    await supabase.from("document_folders").delete().eq("case_id", caseId).or(`path.eq.${full},path.like.${full}/%`);
+    if (!confirm(`Delete empty folder "${full}"?`)) return;
+    await supabase.from("document_folders").delete().eq("case_id", caseId).eq("path", full);
     toast.success("Folder deleted");
     load();
   };
@@ -553,9 +555,6 @@ export function CaseDocumentsTab({ caseId }: { caseId: string }) {
                       <Button variant="ghost" size="icon" onClick={() => renameFolder(f.full)} title="Rename folder">
                         <Pencil className="h-4 w-4" />
                       </Button>
-                      <Button variant="ghost" size="icon" onClick={() => deleteFolder(f.full)} title="Delete folder">
-                        <Trash2 className="h-4 w-4 text-destructive" />
-                      </Button>
                     </td>
                   </tr>
                 ))}
diff --git a/supabase/migrations/20260428003554_2a6c3c06-60aa-4155-998c-a442a62a5e01.sql b/supabase/migrations/20260428003554_2a6c3c06-60aa-4155-998c-a442a62a5e01.sql
new file mode 100644
index 0000000..5c368ac
--- /dev/null
+++ b/supabase/migrations/20260428003554_2a6c3c06-60aa-4155-998c-a442a62a5e01.sql
@@ -0,0 +1,10 @@
+-- Allow updates to documents (for moving between folders) and document_folders (for renaming/moving folders)
+CREATE POLICY documents_update_case ON public.documents
+FOR UPDATE TO authenticated
+USING (can_access_case(case_id, auth.uid()))
+WITH CHECK (can_access_case(case_id, auth.uid()));
+
+CREATE POLICY df_update_case ON public.document_folders
+FOR UPDATE TO authenticated
+USING (can_access_case(case_id, auth.uid()))
+WITH CHECK (can_access_case(case_id, auth.uid()));
\ No newline at end of file