diff --git a/supabase/migrations/20260227010000_restrict_upsert_version_meta_exec.sql b/supabase/migrations/20260227010000_restrict_upsert_version_meta_exec.sql
new file mode 100644
index 0000000000..203d1bfeba
--- /dev/null
+++ b/supabase/migrations/20260227010000_restrict_upsert_version_meta_exec.sql
@@ -0,0 +1,9 @@
+REVOKE ALL ON FUNCTION "public"."upsert_version_meta"("p_app_id" character varying, "p_version_id" bigint, "p_size" bigint)
+FROM
+  "anon",
+  "authenticated";
+
+GRANT
+EXECUTE ON FUNCTION "public"."upsert_version_meta"("p_app_id" character varying, "p_version_id" bigint, "p_size" bigint)
+TO
+  "service_role";