diff --git a/src/lib/db/rls-migrations.test.ts b/src/lib/db/rls-migrations.test.ts
new file mode 100644
index 0000000..1e1414b
--- /dev/null
+++ b/src/lib/db/rls-migrations.test.ts
@@ -0,0 +1,16 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { describe, expect, it } from 'vitest';
+
+describe('RLS migrations', () => {
+  it('keeps the failed_webhook_events RLS migration statement intact', () => {
+    const migration = readFileSync(
+      join(process.cwd(), 'supabase/migrations/0013_failed_webhook_events_rls.sql'),
+      'utf8',
+    );
+
+    expect(migration.toLowerCase()).toMatch(
+      /alter table(?: if exists)? failed_webhook_events enable row level security/,
+    );
+  });
+});
diff --git a/supabase/migrations/0013_failed_webhook_events_rls.sql b/supabase/migrations/0013_failed_webhook_events_rls.sql
new file mode 100644
index 0000000..f8f4bd0
--- /dev/null
+++ b/supabase/migrations/0013_failed_webhook_events_rls.sql
@@ -0,0 +1 @@
+ALTER TABLE IF EXISTS failed_webhook_events ENABLE ROW LEVEL SECURITY;