diff --git a/RLS_SETUP.md b/RLS_SETUP.md
index 27a67b2f..da1d2727 100644
--- a/RLS_SETUP.md
+++ b/RLS_SETUP.md
@@ -52,20 +52,22 @@ SELECT usename, usesuper FROM pg_user WHERE usename = 'crm_user';
 -- Grant connection rights
 GRANT CONNECT ON DATABASE bottlecrm TO crm_user;
 
--- Grant schema usage
-GRANT USAGE ON SCHEMA public TO crm_user;
+-- Grant schema privileges (required for migrations to create/alter tables)
+GRANT ALL ON SCHEMA public TO crm_user;
 
 -- Grant table permissions (SELECT, INSERT, UPDATE, DELETE)
-GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO crm_user;
+GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO crm_user;
 
 -- Grant sequence permissions (for auto-increment fields)
-GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO crm_user;
+GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO crm_user;
 
 -- Grant default privileges for future tables
-ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO crm_user;
-ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO crm_user;
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO crm_user;
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO crm_user;
 ```
 
+> **Note:** Granting schema/table privileges does NOT weaken RLS. These control DDL operations (CREATE/ALTER/DROP), while RLS controls row-level access. Only `BYPASSRLS` attribute or superuser status bypasses RLS.
+
 ---
 
 ## 4. Configure Django Environment
diff --git a/frontend/src/lib/components/users/TeamCard.svelte b/frontend/src/lib/components/users/TeamCard.svelte
index d51e5127..b76a91de 100644
--- a/frontend/src/lib/components/users/TeamCard.svelte
+++ b/frontend/src/lib/components/users/TeamCard.svelte
@@ -75,14 +75,10 @@
 					<Pencil class="h-4 w-4" />
 				</Button>
 				<AlertDialog.Root>
-					<AlertDialog.Trigger>
-						<Button
-							variant="ghost"
-							size="icon"
-							class="text-destructive hover:bg-destructive/10 h-8 w-8"
-						>
-							<Trash2 class="h-4 w-4" />
-						</Button>
+					<AlertDialog.Trigger
+						class="text-destructive hover:bg-destructive/10 inline-flex h-8 w-8 items-center justify-center rounded-md"
+					>
+						<Trash2 class="h-4 w-4" />
 					</AlertDialog.Trigger>
 					<AlertDialog.Content>
 						<AlertDialog.Header>
diff --git a/frontend/src/routes/(app)/users/+page.svelte b/frontend/src/routes/(app)/users/+page.svelte
index 2df5f2f7..a7c6ebb4 100644
--- a/frontend/src/routes/(app)/users/+page.svelte
+++ b/frontend/src/routes/(app)/users/+page.svelte
@@ -434,15 +434,11 @@
 													{:else}
 														<!-- Active user: show Deactivate button -->
 														<AlertDialog.Root>
-															<AlertDialog.Trigger>
-																<Button
-																	variant="ghost"
-																	size="icon"
-																	class="text-destructive hover:bg-destructive/10 h-8 w-8"
-																	title="Deactivate user"
-																>
-																	<Trash2 class="h-4 w-4" />
-																</Button>
+															<AlertDialog.Trigger
+																class="text-destructive hover:bg-destructive/10 inline-flex h-8 w-8 items-center justify-center rounded-md"
+																title="Deactivate user"
+															>
+																<Trash2 class="h-4 w-4" />
 															</AlertDialog.Trigger>
 															<AlertDialog.Content>
 																<AlertDialog.Header>