diff --git a/README.md b/README.md
index 3a9f1afaaf..5fe840c868 100644
--- a/README.md
+++ b/README.md
@@ -213,7 +213,7 @@ the following format:
 }
 ```
 
-and mount it at `/src/usr/app/oauth.json`.
+and mount it at `/usr/src/app/oauth.json`.
 
 For instance with github, it is enough to create a Github OAuth app with
 callback: `https://<yourinstance>/api/oauth/login_callback/github` and use for
diff --git a/backend/migrations/20220123221903_first.up.sql b/backend/migrations/20220123221903_first.up.sql
index 477ee71738..5a372f9d3d 100644
--- a/backend/migrations/20220123221903_first.up.sql
+++ b/backend/migrations/20220123221903_first.up.sql
@@ -2,73 +2,6 @@
 create SCHEMA IF NOT exists extensions;
 create extension if not exists "uuid-ossp"      with schema extensions;
 
-DO
-$do$
-BEGIN
-    IF EXISTS (
-        select usesuper from pg_user where usename = CURRENT_USER AND usesuper = 't') 
-    AND NOT EXISTS (
-        SELECT
-        FROM   pg_catalog.pg_roles
-        WHERE  rolname = 'windmill_user') THEN
-
-        LOCK TABLE pg_catalog.pg_roles;
-
-        CREATE ROLE windmill_user;
-
-        GRANT ALL
-        ON ALL TABLES IN SCHEMA public 
-        TO windmill_user;
-
-        GRANT ALL PRIVILEGES 
-        ON ALL SEQUENCES IN SCHEMA public 
-        TO windmill_user;
-
-        ALTER DEFAULT PRIVILEGES 
-            FOR ROLE windmill_user
-            IN SCHEMA public
-            GRANT ALL ON TABLES TO windmill_user;
-
-        ALTER DEFAULT PRIVILEGES 
-            FOR ROLE windmill_user
-            IN SCHEMA public
-            GRANT ALL ON SEQUENCES TO windmill_user;
-
-    END IF;
-END
-$do$;
-
-DO
-$do$
-BEGIN
-    IF EXISTS (select usesuper from pg_user where usename = CURRENT_USER AND usesuper = 't')
-    AND NOT EXISTS (
-        SELECT
-        FROM   pg_catalog.pg_roles
-        WHERE  rolname = 'windmill_admin') THEN
-        CREATE ROLE windmill_admin WITH BYPASSRLS;
-
-        GRANT ALL
-        ON ALL TABLES IN SCHEMA public 
-        TO windmill_admin;
-
-        GRANT ALL PRIVILEGES 
-        ON ALL SEQUENCES IN SCHEMA public 
-        TO windmill_admin;
-
-        ALTER DEFAULT PRIVILEGES 
-            FOR ROLE windmill_admin
-            IN SCHEMA public
-            GRANT ALL ON TABLES TO windmill_admin;
-
-        ALTER DEFAULT PRIVILEGES 
-            FOR ROLE windmill_admin
-            IN SCHEMA public
-            GRANT ALL ON SEQUENCES TO windmill_admin;
-    END IF;
-END
-$do$;
-
 
 CREATE TABLE workspace (
     id VARCHAR(50) PRIMARY KEY,
@@ -568,3 +501,66 @@ WITH CHECK (exists(
     SELECT f.* FROM group_ g, jsonb_each_text(g.extra_perms) f 
     WHERE usr_to_group.group_ = g.name AND usr_to_group.workspace_id = g.workspace_id AND SPLIT_PART(key, '/', 1) = 'g' AND key = ANY(regexp_split_to_array(current_setting('session.pgroups'), ',')::text[])
     AND value::boolean));
+
+DO
+$do$
+BEGIN
+    IF EXISTS (
+        select usesuper from pg_user where usename = CURRENT_USER AND usesuper = 't') 
+    AND NOT EXISTS (
+        SELECT
+        FROM   pg_catalog.pg_roles
+        WHERE  rolname = 'windmill_user') THEN
+
+        LOCK TABLE pg_catalog.pg_roles;
+
+        CREATE ROLE windmill_user;
+
+        GRANT ALL
+        ON ALL TABLES IN SCHEMA public 
+        TO windmill_user;
+
+        GRANT ALL PRIVILEGES 
+        ON ALL SEQUENCES IN SCHEMA public 
+        TO windmill_user;
+
+        ALTER DEFAULT PRIVILEGES 
+            IN SCHEMA public
+            GRANT ALL ON TABLES TO windmill_user;
+
+        ALTER DEFAULT PRIVILEGES 
+            IN SCHEMA public
+            GRANT ALL ON SEQUENCES TO windmill_user;
+
+    END IF;
+END
+$do$;
+
+DO
+$do$
+BEGIN
+    IF EXISTS (select usesuper from pg_user where usename = CURRENT_USER AND usesuper = 't')
+    AND NOT EXISTS (
+        SELECT
+        FROM   pg_catalog.pg_roles
+        WHERE  rolname = 'windmill_admin') THEN
+        CREATE ROLE windmill_admin WITH BYPASSRLS;
+
+        GRANT ALL
+        ON ALL TABLES IN SCHEMA public 
+        TO windmill_admin;
+
+        GRANT ALL PRIVILEGES 
+        ON ALL SEQUENCES IN SCHEMA public 
+        TO windmill_admin;
+
+        ALTER DEFAULT PRIVILEGES 
+            IN SCHEMA public
+            GRANT ALL ON TABLES TO windmill_admin;
+
+        ALTER DEFAULT PRIVILEGES 
+            IN SCHEMA public
+            GRANT ALL ON SEQUENCES TO windmill_admin;
+    END IF;
+END
+$do$;
diff --git a/init-db-as-superuser.sql b/init-db-as-superuser.sql
index 3633148516..303d1faa04 100644
--- a/init-db-as-superuser.sql
+++ b/init-db-as-superuser.sql
@@ -21,12 +21,10 @@ BEGIN
         TO windmill_user;
 
         ALTER DEFAULT PRIVILEGES 
-            FOR ROLE windmill_user
             IN SCHEMA public
             GRANT ALL ON TABLES TO windmill_user;
 
         ALTER DEFAULT PRIVILEGES 
-            FOR ROLE windmill_user
             IN SCHEMA public
             GRANT ALL ON SEQUENCES TO windmill_user;
 
@@ -53,12 +51,10 @@ BEGIN
         TO windmill_admin;
 
         ALTER DEFAULT PRIVILEGES 
-            FOR ROLE windmill_admin
             IN SCHEMA public
             GRANT ALL ON TABLES TO windmill_admin;
 
         ALTER DEFAULT PRIVILEGES 
-            FOR ROLE windmill_admin
             IN SCHEMA public
             GRANT ALL ON SEQUENCES TO windmill_admin;
     END IF;