diff --git a/ops/sql/SUPABASE-V17.7.4-AUTH-EMAIL-VERIFICATION.sql b/ops/sql/SUPABASE-V17.7.4-AUTH-EMAIL-VERIFICATION.sql
new file mode 100644
index 0000000..e513c97
--- /dev/null
+++ b/ops/sql/SUPABASE-V17.7.4-AUTH-EMAIL-VERIFICATION.sql
@@ -0,0 +1,12 @@
+-- Caterium v17.7.4: require real Supabase email verification for client-created accounts.
+-- The removed triggers trusted raw_user_meta_data.registration_source, which is client-controlled.
+
+begin;
+
+drop trigger if exists caterium_autoconfirm_signup_v25 on auth.users;
+drop trigger if exists caterium_autoverify_identity_v25 on auth.identities;
+
+drop function if exists public.caterium_autoconfirm_signup_v25();
+drop function if exists public.caterium_autoverify_identity_v25();
+
+commit;