diff --git a/src/main/resources/db/migration/V003__passkey_mfa_support.sql b/src/main/resources/db/migration/V003__passkey_mfa_support.sql
new file mode 100644
index 0000000..b5f9cf9
--- /dev/null
+++ b/src/main/resources/db/migration/V003__passkey_mfa_support.sql
@@ -0,0 +1,9 @@
+CREATE TABLE IF NOT EXISTS vendor_auth_policy (
+    id         INTEGER PRIMARY KEY DEFAULT 1 CHECK (id = 1),
+    mfa_mode   VARCHAR(10) NOT NULL DEFAULT 'off',
+    passkey_enabled BOOLEAN NOT NULL DEFAULT false,
+    passkey_mode VARCHAR(10) NOT NULL DEFAULT 'optional',
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+INSERT INTO vendor_auth_policy (id) VALUES (1) ON CONFLICT DO NOTHING;