diff --git a/migrations/015-remote-access.sh b/migrations/015-remote-access.sh
index 07710d9..0546eca 100644
--- a/migrations/015-remote-access.sh
+++ b/migrations/015-remote-access.sh
@@ -153,17 +153,21 @@ case "${1:-}" in
       || { echo "DRIFT role $ROLE missing"; exit 1; }
     [[ $(q "SELECT pg_get_userbyid(datdba) FROM pg_database WHERE datname='$DB'") == "$ROLE" ]] \
       || { echo "DRIFT database $DB missing or not owned by $ROLE"; exit 1; }
-    [[ -f $SECRET ]] || { echo "DRIFT password file $SECRET missing"; exit 1; }
     [[ -f $TLS/server.crt ]] || { echo "DRIFT TLS cert missing"; exit 1; }
     grep -q '^listen_addr = 0.0.0.0' "$INI" || { echo "DRIFT listen_addr not 0.0.0.0"; exit 1; }
     grep -q "^$DB = host=" "$INI" || { echo "DRIFT $DB pool entry missing"; exit 1; }
     grep -q '^client_tls_sslmode = require' "$INI" || { echo "DRIFT client TLS not enforced"; exit 1; }
-    ver=$(q "SELECT rolpassword FROM pg_authid WHERE rolname='$ROLE'")
-    grep -qF "\"$ver\"" "$USERLIST" || { echo "DRIFT userlist verifier out of sync"; exit 1; }
+    # root-only checks: password file (700 dir) and userlist (640 postgres)
+    if [[ $EUID -eq 0 ]]; then
+      [[ -f $SECRET ]] || { echo "DRIFT password file $SECRET missing"; exit 1; }
+      ver=$(q "SELECT rolpassword FROM pg_authid WHERE rolname='$ROLE'")
+      grep -qF "\"$ver\"" "$USERLIST" || { echo "DRIFT userlist verifier out of sync"; exit 1; }
+      note="userlist synced, "
+    fi
     systemctl is-active --quiet pgbouncer || { echo "DRIFT pgbouncer not active"; exit 1; }
     ss -ltn 2>/dev/null | grep -q '0.0.0.0:6432' \
       || { echo "DRIFT not listening on 0.0.0.0:6432"; exit 1; }
-    echo "OK role+db $ROLE, TLS enforced, listening on 0.0.0.0:6432"
+    echo "OK role+db $ROLE, TLS enforced, ${note:-}listening on 0.0.0.0:6432"
     ;;
   down)
     if db_exists; then