diff --git a/supabase/migrations/20260308150000_rotation_config.sql b/supabase/migrations/20260308150000_rotation_config.sql
new file mode 100644
index 00000000..a0ebde3a
--- /dev/null
+++ b/supabase/migrations/20260308150000_rotation_config.sql
@@ -0,0 +1,44 @@
+-- Seed rotation config setting for duty schedule generator
+INSERT INTO app_settings (key, value)
+VALUES (
+  'rotation_config',
+  '{
+    "rotation_order": [],
+    "friday_am_order": [],
+    "excluded_staff_ids": [],
+    "initial_am_staff_id": null,
+    "initial_pm_staff_id": null
+  }'::jsonb
+)
+ON CONFLICT (key) DO NOTHING;
+
+-- Ensure admin/dispatcher can upsert app_settings (for rotation config edits).
+-- A policy may already exist; use IF NOT EXISTS pattern via DO block.
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_policies
+    WHERE tablename = 'app_settings'
+      AND policyname = 'app_settings_admin_upsert'
+  ) THEN
+    EXECUTE $policy$
+      CREATE POLICY app_settings_admin_upsert ON app_settings
+        FOR ALL TO authenticated
+        USING (
+          EXISTS (
+            SELECT 1 FROM profiles
+            WHERE profiles.id = auth.uid()
+              AND profiles.role IN ('admin', 'dispatcher')
+          )
+        )
+        WITH CHECK (
+          EXISTS (
+            SELECT 1 FROM profiles
+            WHERE profiles.id = auth.uid()
+              AND profiles.role IN ('admin', 'dispatcher')
+          )
+        )
+    $policy$;
+  END IF;
+END
+$$;