diff --git a/migrations/cassandra/keyspaces/ess_api/03_init_tables.up.sql b/migrations/cassandra/keyspaces/ess_api/03_init_tables.up.sql
index 87910bcb8..40f593d97 100644
--- a/migrations/cassandra/keyspaces/ess_api/03_init_tables.up.sql
+++ b/migrations/cassandra/keyspaces/ess_api/03_init_tables.up.sql
@@ -27,6 +27,7 @@ CREATE TYPE IF NOT EXISTS ess_api.entity_type (
 CREATE TABLE IF NOT EXISTS ess_api.namespaces (
     namespace                             text,
     oauth_authorizations                  map<text, frozen<authorization>>, -- new primary column for tenant (non-notary) auths, oauth wins over ssa on read-merge
+    ssa_authorizations                    map<text, frozen<authorization>>, -- legacy column kept until all supported ESS versions stop selecting it
     notary_authorizations                 map<text, frozen<authorization>>,
     entity_types                          map<text, frozen<entity_type>>,
     created_at                            timestamp,
diff --git a/migrations/cassandra/keyspaces/ess_api/04_init_ncp_namespace.up.sql b/migrations/cassandra/keyspaces/ess_api/04_init_ncp_namespace.up.sql
index 2075a87ea..c0e287131 100644
--- a/migrations/cassandra/keyspaces/ess_api/04_init_ncp_namespace.up.sql
+++ b/migrations/cassandra/keyspaces/ess_api/04_init_ncp_namespace.up.sql
@@ -5,6 +5,7 @@ INSERT INTO ess_api.namespaces (
   updated_at,
   entity_hash_size,
   require_lwt_for_secret_version_writes,
+  ssa_authorizations,
   notary_authorizations
 )
 VALUES (
@@ -14,5 +15,6 @@ VALUES (
   toTimestamp(now()),
   10,
   False,
+  {'nvcf-api': {id: 'nvcf-api', name: 'nvcf api service client', jwks_url: 'http://openbao-server.vault-system.svc.cluster.local:8200/v1/services/ess-api/jwt/jwks', issuer: 'http://ess-api.ess.svc.cluster.local', type: 'SSA'}},
   {'nvcf-api': {id: 'nvcf-api', name: 'nvcf notary client', jwks_url: 'http://notary.nvcf.svc.cluster.local:8080/.well-known/jwks.json', issuer: 'http://notary.nvcf.svc.cluster.local:8080', type: 'NOTARY'}}
 );
diff --git a/migrations/cassandra/keyspaces/ess_api/05_add_nvct_authorizations.up.sql b/migrations/cassandra/keyspaces/ess_api/05_add_nvct_authorizations.up.sql
new file mode 100644
index 000000000..aa8f2298a
--- /dev/null
+++ b/migrations/cassandra/keyspaces/ess_api/05_add_nvct_authorizations.up.sql
@@ -0,0 +1,28 @@
+-- SSA registration unblocks nvct-api -> ess-api outbound calls, such as
+-- nvct-api writing task secrets.
+--
+-- NOTARY registration unblocks ess-init -> ess-api secret reads from the
+-- worker pod. ess-init presents the notary-signed assertion JWT with sub=
+-- nvct-api, and ess-api looks the subject up in notary_authorizations.
+
+UPDATE ess_api.namespaces
+SET
+  ssa_authorizations = ssa_authorizations + {
+    'nvct-api': {
+      id: 'nvct-api',
+      name: 'nvct api service client',
+      jwks_url: 'http://openbao-server.vault-system.svc.cluster.local:8200/v1/services/ess-api/jwt/jwks',
+      issuer: 'http://ess-api.ess.svc.cluster.local',
+      type: 'SSA'
+    }
+  },
+  notary_authorizations = notary_authorizations + {
+    'nvct-api': {
+      id: 'nvct-api',
+      name: 'nvct api notary client',
+      jwks_url: 'http://notary.nvcf.svc.cluster.local:8080/.well-known/jwks.json',
+      issuer: 'http://notary.nvcf.svc.cluster.local:8080',
+      type: 'NOTARY'
+    }
+  }
+WHERE namespace = 'nvcf';
diff --git a/migrations/cassandra/keyspaces/ess_api/09_restore_legacy_ssa_authorizations.up.sql b/migrations/cassandra/keyspaces/ess_api/09_restore_legacy_ssa_authorizations.up.sql
new file mode 100644
index 000000000..dd9b25862
--- /dev/null
+++ b/migrations/cassandra/keyspaces/ess_api/09_restore_legacy_ssa_authorizations.up.sql
@@ -0,0 +1,28 @@
+-- Keep 0.6.1 compatible with ESS images that still select the legacy
+-- ssa_authorizations column while oauth_authorizations migration is in flight.
+-- The column can be removed in a later release after all supported ESS images
+-- stop selecting it.
+
+ALTER TABLE ess_api.namespaces ADD IF NOT EXISTS (
+    ssa_authorizations map<text, frozen<authorization>>
+);
+
+UPDATE ess_api.namespaces
+SET
+  ssa_authorizations = ssa_authorizations + {
+    'nvcf-api': {
+      id: 'nvcf-api',
+      name: 'nvcf api service client',
+      jwks_url: 'http://openbao-server.vault-system.svc.cluster.local:8200/v1/services/ess-api/jwt/jwks',
+      issuer: 'http://ess-api.ess.svc.cluster.local',
+      type: 'SSA'
+    },
+    'nvct-api': {
+      id: 'nvct-api',
+      name: 'nvct api service client',
+      jwks_url: 'http://openbao-server.vault-system.svc.cluster.local:8200/v1/services/ess-api/jwt/jwks',
+      issuer: 'http://ess-api.ess.svc.cluster.local',
+      type: 'SSA'
+    }
+  }
+WHERE namespace = 'nvcf';