diff --git a/priv/repo/migrations/20260127124937_ensure_system_actor_user_exists.exs b/priv/repo/migrations/20260127124937_ensure_system_actor_user_exists.exs
index b675cf3..8856bb2 100644
--- a/priv/repo/migrations/20260127124937_ensure_system_actor_user_exists.exs
+++ b/priv/repo/migrations/20260127124937_ensure_system_actor_user_exists.exs
@@ -41,15 +41,16 @@ defmodule Mv.Repo.Migrations.EnsureSystemActorUserExists do
     end
   end
 
-  defp ensure_system_actor_user_exists(admin_role_id) do
+  defp ensure_system_actor_user_exists(_admin_role_id) do
     case repo().one(from(u in "users", where: u.email == ^@system_user_email, select: u.id)) do
       nil ->
-        # Use uuid_generate_v7() for consistency with roles insert in this migration
-        role_id_str = uuid_to_string(admin_role_id)
-
+        # Use subquery for role_id to avoid nil/empty-string UUID (CI can lag after role insert)
         execute("""
         INSERT INTO users (id, email, hashed_password, oidc_id, member_id, role_id)
-        VALUES (uuid_generate_v7(), '#{@system_user_email}', NULL, NULL, NULL, '#{role_id_str}'::uuid)
+        SELECT uuid_generate_v7(), '#{@system_user_email}', NULL, NULL, NULL, r.id
+        FROM roles r
+        WHERE r.name = 'Admin'
+        LIMIT 1
         """)
 
         IO.puts("✅ Created system actor user (#{@system_user_email})")
@@ -58,11 +59,4 @@ defmodule Mv.Repo.Migrations.EnsureSystemActorUserExists do
         :ok
     end
   end
-
-  defp uuid_to_string(id) when is_binary(id) do
-    {:ok, str} = Ecto.UUID.load(id)
-    str
-  end
-
-  defp uuid_to_string(id), do: to_string(id)
 end