diff --git a/supabase/migrations/20260922110544_public_signup_policy_security.sql b/supabase/migrations/20260922110544_public_signup_policy_security.sql
new file mode 100644
index 0000000..dded67d
--- /dev/null
+++ b/supabase/migrations/20260922110544_public_signup_policy_security.sql
@@ -0,0 +1,18 @@
+-- Caterium v17.9.1
+-- The public signup policy returns constants only and does not need elevated privileges.
+
+create or replace function public.caterium_public_signup_policy()
+returns jsonb
+language sql
+stable
+security invoker
+set search_path = public
+as $function$
+  select jsonb_build_object(
+    'promo_optional', true,
+    'default_plan', 'basic'
+  );
+$function$;
+
+revoke all on function public.caterium_public_signup_policy() from public,anon,authenticated;
+grant execute on function public.caterium_public_signup_policy() to anon,authenticated;