diff --git a/docker-compose.yml b/docker-compose.yml
index fde092dd8..aebefe99d 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -22,7 +22,7 @@ services:
       JWT_EXP: 3600
     volumes:
       - db_data:/var/lib/postgresql/data
-      - ./supabase/roles.sql:/docker-entrypoint-initdb.d/zz-roles.sql:ro
+      - ./docker/db-init/roles.sql:/docker-entrypoint-initdb.d/zz-roles.sql:ro
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U postgres"]
       interval: 5s
diff --git a/supabase/roles.sql b/docker/db-init/roles.sql
similarity index 70%
rename from supabase/roles.sql
rename to docker/db-init/roles.sql
index b70b422b9..e0db8a089 100644
--- a/supabase/roles.sql
+++ b/docker/db-init/roles.sql
@@ -1,6 +1,9 @@
 -- Runs once on first DB init (after the supabase/postgres image creates its
 -- base roles). Guarantees GoTrue and PostgREST can log in with POSTGRES_PASSWORD.
 -- ponytail: only forces the two login passwords; everything else the image sets up.
+-- Must NOT live under supabase/ — the Supabase CLI seeds supabase/roles.sql on
+-- `supabase start` as a non-superuser, where altering supabase_auth_admin is
+-- rejected as a reserved role (42501). Here it runs as the init superuser.
 do $$
 begin
   if exists (select from pg_roles where rolname = 'supabase_auth_admin') then