diff --git a/spindle/db/db.go b/spindle/db/db.go
index 76b4b630..0677cb42 100644
--- a/spindle/db/db.go
+++ b/spindle/db/db.go
@@ -325,6 +325,25 @@ func runMigrations(_ context.Context, conn *sql.Conn, logger *slog.Logger) error
 		return err
 	}
 
+	// NOTE: this should be called *after* we created acl_2 table
+	// NOTE: what if we can reuse existing 'acl' table? they will be roughly same.
+	if err := orm.RunMigration(conn, logger, "switch-to-rbac-v2", func(tx *sql.Tx) error {
+		_, err := tx.Exec(`
+
+
+
+			-- insert into acl_2 (p_type, v0, v1, v2)
+			-- select 'g', (distinct v0), 'tngl_spindle', v2
+			-- from acl
+			-- where p_type = 'p' and v1 = 'thisserver' and v3 = 'repo:collaborator';
+
+
+		`)
+		return err
+	}); err != nil {
+		return err
+	}
+
 	return nil
 }