diff --git a/backend/migrations/20260701080313_grant_dispatch_event_to_windmill_roles.down.sql b/backend/migrations/20260701080313_grant_dispatch_event_to_windmill_roles.down.sql
new file mode 100644
index 0000000000..2278fbfb2e
--- /dev/null
+++ b/backend/migrations/20260701080313_grant_dispatch_event_to_windmill_roles.down.sql
@@ -0,0 +1,4 @@
+REVOKE ALL ON dispatch_event FROM windmill_user;
+REVOKE ALL ON dispatch_event FROM windmill_admin;
+REVOKE ALL ON SEQUENCE dispatch_event_id_seq FROM windmill_user;
+REVOKE ALL ON SEQUENCE dispatch_event_id_seq FROM windmill_admin;
diff --git a/backend/migrations/20260701080313_grant_dispatch_event_to_windmill_roles.up.sql b/backend/migrations/20260701080313_grant_dispatch_event_to_windmill_roles.up.sql
new file mode 100644
index 0000000000..5d0b4650ce
--- /dev/null
+++ b/backend/migrations/20260701080313_grant_dispatch_event_to_windmill_roles.up.sql
@@ -0,0 +1,15 @@
+-- The dispatch_event table (migration 20260523055641_dispatch_event) was
+-- created relying on ALTER DEFAULT PRIVILEGES to grant access to windmill_user
+-- and windmill_admin. Those default privileges only apply to objects created by
+-- the role that set them (migration 20250205131523), so deployments whose
+-- migration runner is a different role leave dispatch_event ungranted. Direct
+-- writes run as the invoking role -- the dispatcher insert (asset_dispatch.rs)
+-- and the DELETE in delete_jobs (windmill-common/src/jobs.rs), reached whenever
+-- a job's side rows are reaped, e.g. on schedule disable -- and fail with
+-- "permission denied for table dispatch_event". Grant explicitly to guarantee
+-- access regardless of who ran the migrations (same fix as notify_event in
+-- 20260619091631 and script_trigger in 20260619112847).
+GRANT ALL ON dispatch_event TO windmill_user;
+GRANT ALL ON dispatch_event TO windmill_admin;
+GRANT ALL ON SEQUENCE dispatch_event_id_seq TO windmill_user;
+GRANT ALL ON SEQUENCE dispatch_event_id_seq TO windmill_admin;