diff --git a/db/iam/changesets/006-documents-delete-permission.sql b/db/iam/changesets/006-documents-delete-permission.sql
index 9f30746..cd89372 100644
--- a/db/iam/changesets/006-documents-delete-permission.sql
+++ b/db/iam/changesets/006-documents-delete-permission.sql
@@ -15,8 +15,9 @@ INSERT INTO iam._legacy_perm_map (legacy_code, v2_code) VALUES
 ON CONFLICT (legacy_code, v2_code) DO NOTHING;
 
 INSERT INTO iam.role_permissions (role_id, permission_code)
-SELECT r.id, 'documents.delete'
-  FROM iam.roles r
- WHERE r.is_system = true
-   AND r.code IN ('tenant_admin')
+SELECT sr.id, 'documents.delete'
+  FROM iam.roles sr
+ WHERE sr.code = 'tenant_admin'
+   AND sr.is_system
+   AND sr.tenant_id IS NULL
 ON CONFLICT DO NOTHING;