diff --git a/backend/app/core/config.py b/backend/app/core/config.py
index d8cbfe2f..5d31b789 100644
--- a/backend/app/core/config.py
+++ b/backend/app/core/config.py
@@ -23,10 +23,19 @@ class Settings(BaseSettings):
             return v.replace("postgresql://", "postgresql+asyncpg://", 1)
         return v
 
-    @property
-    def DATABASE_URL_SYNC(self) -> str:
-        """Get sync URL by removing asyncpg prefix from DATABASE_URL."""
-        return self.DATABASE_URL.replace("postgresql+asyncpg://", "postgresql://", 1)
+    # Sync URL for Alembic migrations. Defaults to DATABASE_URL (sync-converted).
+    # Set explicitly in .env to use a different role for migrations (e.g. superuser)
+    # when DATABASE_URL has been switched to the app role.
+    DATABASE_URL_SYNC: str = ""
+
+    @field_validator("DATABASE_URL_SYNC", mode="before")
+    @classmethod
+    def default_database_url_sync(cls, v: str, info) -> str:
+        """Fall back to sync-converted DATABASE_URL if not explicitly set."""
+        if not v:
+            base = info.data.get("DATABASE_URL", "")
+            return base.replace("postgresql+asyncpg://", "postgresql://", 1)
+        return v
 
     # Admin database — resolutionflow_admin role, BYPASSRLS.
     # Used by /admin/* endpoints. Defaults to DATABASE_URL for local dev.