diff --git a/ops/sql/SUPABASE-V17.7.4-PASSWORD-SECURITY.sql b/ops/sql/SUPABASE-V17.7.4-PASSWORD-SECURITY.sql
new file mode 100644
index 0000000..3f1b244
--- /dev/null
+++ b/ops/sql/SUPABASE-V17.7.4-PASSWORD-SECURITY.sql
@@ -0,0 +1,15 @@
+-- Caterium v17.7.4: move mandatory temporary-password state to server-controlled app metadata.
+-- Legacy user_metadata is client-editable and must not be trusted for this security state.
+
+begin;
+
+update auth.users
+set raw_app_meta_data = coalesce(raw_app_meta_data, '{}'::jsonb)
+  || jsonb_build_object(
+    'must_change_password', true,
+    'password_policy_version', 'v1774'
+  )
+where lower(coalesce(raw_user_meta_data->>'must_change_password', '')) = 'true'
+  and lower(coalesce(raw_app_meta_data->>'must_change_password', 'false')) <> 'true';
+
+commit;