Index: backend/src/main/resources/application.properties
===================================================================
--- backend/src/main/resources/application.properties	(revision 3ebe47cce61b3bfc1dee2566f7475e378374591e)
+++ backend/src/main/resources/application.properties	(revision 8c01a1f14ebd23dc0aeffe2d391546a92ddde9f9)
@@ -4,5 +4,11 @@
 # JPA & Hibernate
 # ============================
-spring.jpa.hibernate.ddl-auto=update
+# NOTE: On some managed PostgreSQL providers the app user cannot read pg_catalog views
+# like pg_settings. Hibernate schema migration/metadata introspection can trigger that
+# access during startup (e.g., when ddl-auto=update).
+#
+# Default to no automatic DDL. Override locally if your DB user has sufficient rights:
+#   export SPRING_JPA_HIBERNATE_DDL_AUTO=update
+spring.jpa.hibernate.ddl-auto=${SPRING_JPA_HIBERNATE_DDL_AUTO:none}
 spring.jpa.properties.hibernate.dialect=org.hibernate.dialect.PostgreSQLDialect
 spring.jpa.show-sql=false
@@ -10,4 +16,7 @@
 spring.jpa.properties.hibernate.default_schema=trekr
 spring.jpa.properties.hibernate.hbm2ddl.create_namespaces=true
+
+# Avoid JDBC metadata access on boot (further reduces pg_catalog permission requirements)
+spring.jpa.properties.hibernate.boot.allow_jdbc_metadata_access=false
 
 # ============================