diff --git a/db/migrations/0005_water_admin_pin_hash.sql b/db/migrations/0005_water_admin_pin_hash.sql
new file mode 100644
index 0000000..28b30f9
--- /dev/null
+++ b/db/migrations/0005_water_admin_pin_hash.sql
@@ -0,0 +1,19 @@
+-- ============================================================================
+-- 0005_water_admin_pin_hash.sql
+--
+-- The Drizzle schema (db/schema/water-log.ts) declares
+-- `water_admin_settings.pin_hash TEXT` for storing the hashed admin PIN.
+-- The original table was created in 0090_water_log_completion.sql without
+-- that column, so every Drizzle `select()` / `insert()` against the table
+-- throws `column "pin_hash" does not exist`, which the water-admin auth
+-- route surfaces as 500 "Server error" and the settings page can't load
+-- (the action's promise rejects inside withBrand, leaving the page stuck
+-- on "Loading…").
+--
+-- The 0004 migration that previously created this table was a no-op
+-- against prod (the table already existed from 0090) and so didn't add
+-- the column either. This migration fixes that.
+-- ============================================================================
+
+ALTER TABLE water_admin_settings
+  ADD COLUMN IF NOT EXISTS pin_hash TEXT;