diff --git a/db/iam/changesets/005-iam-v2-roles-crud.sql b/db/iam/changesets/005-iam-v2-roles-crud.sql
index 1ae4e78..a1aa6a4 100644
--- a/db/iam/changesets/005-iam-v2-roles-crud.sql
+++ b/db/iam/changesets/005-iam-v2-roles-crud.sql
@@ -230,6 +230,49 @@ FROM iam.roles_v2 sr
 WHERE u.role_id IS NULL
   AND sr.code = 'operativo' AND sr.tenant_id = u.tenant_id;
 
+--changeset panel:iam-005g2-ensure-role-backfill endDelimiter:; splitStatements:true
+--preconditions onFail:MARK_RAN
+--precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM information_schema.columns WHERE table_schema='iam' AND table_name='roles' AND column_name='id'
+INSERT INTO iam.roles_v2 (tenant_id, code, label, is_system)
+SELECT DISTINCT u.tenant_id, 'operativo', 'Operativo', false
+FROM iam.users u
+WHERE u.tenant_id IS NOT NULL
+  AND NOT EXISTS (
+    SELECT 1 FROM iam.roles_v2 r
+    WHERE r.tenant_id = u.tenant_id AND r.code = 'operativo'
+  );
+
+UPDATE iam.users u
+SET role_id = sr.id
+FROM iam.roles_v2 sr
+WHERE u.role_code = 'tenant_admin'
+  AND sr.code = 'tenant_admin' AND sr.is_system AND sr.tenant_id IS NULL
+  AND u.role_id IS NULL;
+
+UPDATE iam.users u
+SET role_id = sr.id
+FROM iam.roles_v2 sr
+WHERE u.role_id IS NULL
+  AND u.tenant_id IS NOT NULL
+  AND sr.code = 'operativo' AND sr.tenant_id = u.tenant_id;
+
+UPDATE iam.users u
+SET role_id = op.id
+FROM iam.roles_v2 sr, iam.roles_v2 op
+WHERE u.role_id = sr.id
+  AND sr.code = 'tenant_admin' AND sr.is_system AND sr.tenant_id IS NULL
+  AND u.tenant_id IS NOT NULL
+  AND op.code = 'operativo' AND op.tenant_id = u.tenant_id
+  AND u.id <> (
+    SELECT MIN(u2.id)
+    FROM iam.users u2
+    JOIN iam.roles_v2 sr2 ON sr2.id = u2.role_id
+    WHERE u2.tenant_id = u.tenant_id
+      AND sr2.code = 'tenant_admin' AND sr2.is_system AND sr2.tenant_id IS NULL
+  );
+
+DELETE FROM iam.users WHERE role_id IS NULL AND tenant_id IS NULL;
+
 --changeset panel:iam-005h-swap-roles endDelimiter:; splitStatements:true
 --preconditions onFail:MARK_RAN
 --precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM information_schema.columns WHERE table_schema='iam' AND table_name='roles' AND column_name='id'
@@ -251,6 +294,7 @@ ALTER TABLE iam.users
 
 ALTER TABLE iam.users ALTER COLUMN role_id SET NOT NULL;
 
+--changeset panel:iam-005h2-unique-tenant-admin splitStatements:false
 DO $$
 DECLARE
   v_admin_role_id bigint;