diff --git a/prisma/migrations/20260505000000_add_admin_role_must_reset_cancelled/migration.sql b/prisma/migrations/20260505000000_add_admin_role_must_reset_cancelled/migration.sql
new file mode 100644
index 0000000..22b32f1
--- /dev/null
+++ b/prisma/migrations/20260505000000_add_admin_role_must_reset_cancelled/migration.sql
@@ -0,0 +1,6 @@
+-- ALTER TYPE ADD VALUE cannot run inside a transaction in PostgreSQL
+ALTER TYPE "Role" ADD VALUE IF NOT EXISTS 'ADMIN';
+
+BEGIN;
+ALTER TABLE "users" ADD COLUMN IF NOT EXISTS "must_reset_password" BOOLEAN NOT NULL DEFAULT false;
+COMMIT;
diff --git a/prisma/schema.prisma b/prisma/schema.prisma
index a60674c..d1d58ed 100644
--- a/prisma/schema.prisma
+++ b/prisma/schema.prisma
@@ -15,6 +15,7 @@ enum Role {
   PRODUCT_OWNER
   SCRUM_MASTER
   DEVELOPER
+  ADMIN
 }
 
 enum StoryStatus {
@@ -108,6 +109,7 @@ model User {
   is_demo            Boolean          @default(false)
   bio                String?          @db.VarChar(160)
   bio_detail         String?          @db.VarChar(2000)
+  must_reset_password Boolean         @default(false)
   avatar_data        Bytes?
   active_product_id  String?
   active_product     Product?         @relation("UserActiveProduct", fields: [active_product_id], references: [id], onDelete: SetNull)