diff --git a/packages/database/src/push-schema.ts b/packages/database/src/push-schema.ts
index ff49134e..df97f3c1 100644
--- a/packages/database/src/push-schema.ts
+++ b/packages/database/src/push-schema.ts
@@ -2,8 +2,6 @@
  * Push schema to database using drizzle-orm's migrate API.
  * Workaround for drizzle-kit CJS/.js extension issue.
  */
-import { resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
 import postgres from 'postgres';
 import { drizzle } from 'drizzle-orm/postgres-js';
 import { sql } from 'drizzle-orm';
@@ -1498,7 +1496,34 @@ async function main() {
   await pushSchema();
 }
 
-if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+// NOT an import.meta.url comparison (tried realpathSync AND plain
+// path.resolve, both wrong for the same reason): tsup's ESM output code-
+// splits this file's top-level statements into a SHARED CHUNK
+// (dist/chunk-*.js), so import.meta.url here resolves to that chunk's own
+// URL, not to push-schema.js's -- confirmed with debug logging, which
+// showed import.meta.url pointing at the chunk file on BOTH the direct
+// `node push-schema.js` invocation and run-migrations.js's import, with
+// process.argv[1] correctly showing 'push-schema.js' each time. Any
+// import.meta.url-based "am I the entry point" check is fundamentally
+// unreliable once a bundler is free to move module code into a shared
+// chunk. Checking argv[1]'s own filename instead sidesteps chunking
+// entirely -- it only asks what script node was told to run, never where
+// the executing code happens to live.
+//
+// WHY THIS MATTERS: run-migrations.ts imports and calls pushSchema()
+// directly (migration-runner.ts), so it never depended on this guard and
+// always worked. permission-smoke.integration.spec.ts's beforeAll runs
+// `node packages/database/dist/push-schema.js` standalone a second time in
+// the same CI job (to prove role_permissions grants survive a re-run
+// against already-seeded data) -- with the guard false, main() was never
+// called, so nothing ran: no thrown error, no output, exit code 0, and
+// integration_service came back with zero grants.
+function isDirectlyExecuted(): boolean {
+  const entry = process.argv[1];
+  return !!entry && /(^|[\\/])push-schema\.(m?js|cjs)$/.test(entry);
+}
+
+if (isDirectlyExecuted()) {
   main().catch((err) => {
     console.error('Push failed:', err);
     process.exit(1);