diff --git a/internal/store/migrations/0017_users_extensions.sql b/internal/store/migrations/0017_users_extensions.sql
new file mode 100644
index 0000000..715b292
--- /dev/null
+++ b/internal/store/migrations/0017_users_extensions.sql
@@ -0,0 +1,21 @@
+-- 0017_users_extensions.sql
+--
+-- Add the columns the user-management UI needs:
+--   email                 — optional, free-form text; format-checked
+--                           in Go on insert/update via net/mail.ParseAddress
+--   disabled_at           — soft-delete tombstone. NULL = enabled
+--   must_change_password  — flag set by admin-create + setup-token flow;
+--                           cleared by /setup or /settings/account
+--
+-- Plus a case-insensitive unique index so 'Alice' and 'alice' can't
+-- both exist (lowercase normalisation is applied in the Go layer
+-- on every CreateUser; this index defends the invariant).
+--
+-- Column-level ALTERs (CLAUDE.md prefers these over rebuilds; safe
+-- under foreign_keys=ON).
+
+ALTER TABLE users ADD COLUMN email TEXT;
+ALTER TABLE users ADD COLUMN disabled_at TEXT;
+ALTER TABLE users ADD COLUMN must_change_password INTEGER NOT NULL DEFAULT 0;
+
+CREATE UNIQUE INDEX users_username_lower ON users(LOWER(username));