diff --git a/RLS_SETUP.md b/RLS_SETUP.md
index 5d4be8e9..55060889 100644
--- a/RLS_SETUP.md
+++ b/RLS_SETUP.md
@@ -229,14 +229,14 @@ Each table has two policies:
    ```sql
    CREATE POLICY org_isolation ON "lead"
        FOR ALL
-       USING (org_id::text = NULLIF(current_setting('app.current_org', true), ''));
+       USING (org_id::text = (select NULLIF(current_setting('app.current_org', true), '')));
    ```
 
 2. **Insert Check Policy**:
    ```sql
    CREATE POLICY org_insert_check ON "lead"
        FOR INSERT
-       WITH CHECK (org_id::text = NULLIF(current_setting('app.current_org', true), ''));
+       WITH CHECK (org_id::text = (select NULLIF(current_setting('app.current_org', true), '')));
    ```
 
 The `NULLIF(..., '')` ensures **no rows are returned** when context is not set (fail-safe).
diff --git a/backend/common/rls/__init__.py b/backend/common/rls/__init__.py
index de166d97..becb29be 100644
--- a/backend/common/rls/__init__.py
+++ b/backend/common/rls/__init__.py
@@ -196,14 +196,14 @@ def get_enable_policy_sql(table):
         CREATE POLICY {ISOLATION_POLICY} ON "{table}"
             FOR ALL
             USING (
-                org_id::text = NULLIF(current_setting('{CONTEXT_VARIABLE}', true), '')
+                org_id::text = (select NULLIF(current_setting('{CONTEXT_VARIABLE}', true), ''))
             );
 
         -- Create insert check policy
         CREATE POLICY {INSERT_POLICY} ON "{table}"
             FOR INSERT
             WITH CHECK (
-                org_id::text = NULLIF(current_setting('{CONTEXT_VARIABLE}', true), '')
+                org_id::text = (select NULLIF(current_setting('{CONTEXT_VARIABLE}', true), ''))
             );
     """