diff --git a/ops/sql/SUPABASE-V17.7.4-ADVISOR-HARDENING.sql b/ops/sql/SUPABASE-V17.7.4-ADVISOR-HARDENING.sql
new file mode 100644
index 0000000..c058d21
--- /dev/null
+++ b/ops/sql/SUPABASE-V17.7.4-ADVISOR-HARDENING.sql
@@ -0,0 +1,23 @@
+begin;
+
+-- Keep the same RLS semantics while evaluating auth.uid() once per statement.
+alter policy sun_chat_reads_read_v29 on public.sun_chat_reads
+  using ((user_id = (select auth.uid())) and public.sun_chat_can_access_thread_v29(thread_id));
+
+-- Cover foreign keys used by chat joins/deletes.
+create index if not exists sun_chat_messages_sender_user_id_idx on public.sun_chat_messages(sender_user_id);
+create index if not exists sun_chat_participants_workspace_id_idx on public.sun_chat_participants(workspace_id);
+create index if not exists sun_chat_reads_workspace_id_idx on public.sun_chat_reads(workspace_id);
+create index if not exists sun_chat_threads_created_by_idx on public.sun_chat_threads(created_by);
+
+-- Remove exact duplicate indexes, retaining the clearer canonical names.
+drop index if exists public.sun_v17_error_workspace_created_idx;
+drop index if exists public.sun_v17_orders_due_idx;
+
+-- Server order automation is for signed-in workspace members only.
+revoke execute on function public.sun_run_order_automation(uuid) from public;
+revoke execute on function public.sun_run_order_automation(uuid) from anon;
+grant execute on function public.sun_run_order_automation(uuid) to authenticated;
+grant execute on function public.sun_run_order_automation(uuid) to service_role;
+
+commit;