Index: backend/src/main/resources/application.properties
===================================================================
--- backend/src/main/resources/application.properties	(revision 86158850756b7b97df263e784aecbbae73d37b17)
+++ backend/src/main/resources/application.properties	(revision 5c20c64185ecffb14d2efb75c8120977f8a6bcec)
@@ -4,5 +4,11 @@
 # JPA & Hibernate
 # ============================
-spring.jpa.hibernate.ddl-auto=update
+# NOTE: On some managed PostgreSQL providers the app user cannot read pg_catalog views
+# like pg_settings. Hibernate schema migration/metadata introspection can trigger that
+# access during startup (e.g., when ddl-auto=update).
+#
+# Default to no automatic DDL. Override locally if your DB user has sufficient rights:
+#   export SPRING_JPA_HIBERNATE_DDL_AUTO=update
+spring.jpa.hibernate.ddl-auto=${SPRING_JPA_HIBERNATE_DDL_AUTO:none}
 spring.jpa.properties.hibernate.dialect=org.hibernate.dialect.PostgreSQLDialect
 spring.jpa.show-sql=false
@@ -10,4 +16,7 @@
 spring.jpa.properties.hibernate.default_schema=trekr
 spring.jpa.properties.hibernate.hbm2ddl.create_namespaces=true
+
+# Avoid JDBC metadata access on boot (further reduces pg_catalog permission requirements)
+spring.jpa.properties.hibernate.boot.allow_jdbc_metadata_access=false
 
 # ============================