diff --git a/dms/internal/audittrail/append_only_test.go b/dms/internal/audittrail/append_only_test.go
index 41252ce3..f659c214 100644
--- a/dms/internal/audittrail/append_only_test.go
+++ b/dms/internal/audittrail/append_only_test.go
@@ -28,7 +28,7 @@ func setupAppendOnlyTest(t *testing.T) (*pgxpool.Pool, func()) {
 	}
 	ctx := context.Background()
 
-	pool := testdb.Pool(t, adminDSN)
+	pool, schema := testdb.PoolWithSchema(t, adminDSN, nil)
 	if _, err := pool.Exec(ctx, `
 		CREATE TABLE IF NOT EXISTS audit_log (
 			id BIGSERIAL PRIMARY KEY, occurred_at TIMESTAMPTZ NOT NULL DEFAULT now(), actor TEXT NOT NULL,
@@ -56,6 +56,8 @@ func setupAppendOnlyTest(t *testing.T) (*pgxpool.Pool, func()) {
 		REVOKE ALL ON audit_log FROM PUBLIC;
 		REVOKE ALL ON audit_log FROM nexarch_app;
 		GRANT INSERT, SELECT ON audit_log TO nexarch_app;
+		GRANT USAGE ON SEQUENCE audit_log_id_seq TO nexarch_app;
+		GRANT USAGE ON SCHEMA `+schema+` TO nexarch_app;
 	`); err != nil {
 		t.Fatalf("schema: %v", err)
 	}
diff --git a/dms/migrations/tenant/0036_audit_log_sequence_grant.down.sql b/dms/migrations/tenant/0036_audit_log_sequence_grant.down.sql
new file mode 100644
index 00000000..aa27609e
--- /dev/null
+++ b/dms/migrations/tenant/0036_audit_log_sequence_grant.down.sql
@@ -0,0 +1 @@
+REVOKE USAGE ON SEQUENCE audit_log_id_seq FROM nexarch_app;
diff --git a/dms/migrations/tenant/0036_audit_log_sequence_grant.up.sql b/dms/migrations/tenant/0036_audit_log_sequence_grant.up.sql
new file mode 100644
index 00000000..4a332050
--- /dev/null
+++ b/dms/migrations/tenant/0036_audit_log_sequence_grant.up.sql
@@ -0,0 +1,6 @@
+-- Migration 0013 gibt nexarch_app nur INSERT/SELECT auf audit_log. Eine
+-- Login-Rolle, die Mitglied von nexarch_app, aber nicht Tabelleneigentuemerin
+-- ist, braucht fuer die BIGSERIAL-Spalte id zusaetzlich USAGE auf die
+-- Sequenz; sonst scheitert jeder INSERT mit "permission denied for sequence
+-- audit_log_id_seq".
+GRANT USAGE ON SEQUENCE audit_log_id_seq TO nexarch_app;