diff --git a/src/encryptid/schema.sql b/src/encryptid/schema.sql
index a510ca8..ac11fd8 100644
--- a/src/encryptid/schema.sql
+++ b/src/encryptid/schema.sql
@@ -457,6 +457,9 @@ CREATE INDEX IF NOT EXISTS idx_legacy_identities_pubkey ON legacy_identities(leg
 -- MIGRATION: Rename authority verticals (voting/moderation/curation/treasury/membership → gov-ops/fin-ops/dev-ops)
 -- ============================================================================
 
+-- Drop old CHECK constraint first so UPDATEs can set new values
+ALTER TABLE delegations DROP CONSTRAINT IF EXISTS delegations_authority_check;
+
 -- Migrate existing delegation data
 UPDATE delegations SET authority = 'gov-ops' WHERE authority IN ('voting', 'moderation');
 UPDATE delegations SET authority = 'fin-ops' WHERE authority = 'treasury';
@@ -472,6 +475,5 @@ UPDATE trust_events SET authority = 'gov-ops' WHERE authority IN ('voting', 'mod
 UPDATE trust_events SET authority = 'fin-ops' WHERE authority = 'treasury';
 UPDATE trust_events SET authority = 'dev-ops' WHERE authority IN ('curation', 'membership');
 
--- Update CHECK constraint on delegations table
-ALTER TABLE delegations DROP CONSTRAINT IF EXISTS delegations_authority_check;
+-- Add new CHECK constraint with updated values
 ALTER TABLE delegations ADD CONSTRAINT delegations_authority_check CHECK (authority IN ('gov-ops', 'fin-ops', 'dev-ops', 'custom'));