diff --git a/deploy/sql/头程数据库统一增量-MySQL8.sql b/deploy/sql/头程数据库统一增量-MySQL8.sql
index c3bae2f6a..6250afaf5 100644
--- a/deploy/sql/头程数据库统一增量-MySQL8.sql
+++ b/deploy/sql/头程数据库统一增量-MySQL8.sql
@@ -1421,7 +1421,8 @@ SELECT 4000001, id, 0
 FROM iam_permission
 WHERE tenant_id = 0 AND app_code = 'PLATFORM'
   AND permission_code IN (
-    'platform:customer:edit', 'platform:customer:status', 'platform:user:grant-role',
+    'platform:customer:edit', 'platform:customer:status', 'platform:customer:reset-password',
+    'platform:customer:delete', 'platform:customer:impersonate', 'platform:user:grant-role',
     'platform:permission:edit', 'platform:permission:status', 'platform:permission:delete',
     'platform:express:list', 'platform:express:create', 'platform:express:edit', 'platform:express:status', 'platform:express:import',
     'platform:counterparty:list', 'platform:counterparty:create', 'platform:counterparty:edit', 'platform:counterparty:status',
@@ -6821,6 +6822,32 @@ BEGIN
     SIGNAL SQLSTATE '45000'
       SET MESSAGE_TEXT = '统一迁移失败：客户尺寸计算配置权限父节点企业客户不存在';
   END IF;
+  IF (SELECT COUNT(*) FROM information_schema.columns
+       WHERE table_schema = 'baiyue_auth' AND table_name = 'auth_account'
+         AND column_name = 'password_change_required') <> 1 THEN
+    SIGNAL SQLSTATE '45000'
+      SET MESSAGE_TEXT = '统一迁移失败：客户管理员强制改密字段未创建';
+  END IF;
+  IF (SELECT COUNT(*) FROM baiyue_iam.iam_permission
+       WHERE tenant_id = 0 AND app_code = 'PLATFORM' AND permission_type = 'BUTTON'
+         AND parent_id = 5100010 AND status = 'ACTIVE' AND deleted = 0
+         AND ((id = 5100016 AND permission_code = 'platform:customer:reset-password')
+           OR (id = 5100017 AND permission_code = 'platform:customer:delete')
+           OR (id = 5100018 AND permission_code = 'platform:customer:impersonate'))) <> 3 THEN
+    SIGNAL SQLSTATE '45000'
+      SET MESSAGE_TEXT = '统一迁移失败：平台客户操作权限未完整创建';
+  END IF;
+  IF (SELECT COUNT(DISTINCT p.permission_code)
+        FROM baiyue_iam.iam_role_permission rp
+        JOIN baiyue_iam.iam_role r ON r.id = rp.role_id AND r.tenant_id = rp.tenant_id
+        JOIN baiyue_iam.iam_permission p ON p.id = rp.permission_id AND p.tenant_id = rp.tenant_id
+       WHERE r.tenant_id = 0 AND r.app_code = 'PLATFORM' AND r.role_code = 'PLATFORM_ADMIN'
+         AND p.permission_code IN ('platform:customer:reset-password',
+                                   'platform:customer:delete',
+                                   'platform:customer:impersonate')) <> 3 THEN
+    SIGNAL SQLSTATE '45000'
+      SET MESSAGE_TEXT = '统一迁移失败：平台管理员未获得客户操作权限';
+  END IF;
   IF (SELECT COUNT(*) FROM baiyue_iam.iam_permission
        WHERE tenant_id = 0 AND app_code = 'PLATFORM' AND permission_type = 'BUTTON'
          AND parent_id = 5100010 AND status = 'ACTIVE' AND deleted = 0
diff --git a/iam/src/test/java/com/baiyue/iam/repository/CustomerProfileMigrationContractTest.java b/iam/src/test/java/com/baiyue/iam/repository/CustomerProfileMigrationContractTest.java
index fd566636c..48b2738bf 100644
--- a/iam/src/test/java/com/baiyue/iam/repository/CustomerProfileMigrationContractTest.java
+++ b/iam/src/test/java/com/baiyue/iam/repository/CustomerProfileMigrationContractTest.java
@@ -80,4 +80,21 @@ class CustomerProfileMigrationContractTest {
                 .contains("全局 `MERCHANT_OWNER` 角色模板")
                 .contains("测试环境只执行当前固定入口");
     }
+
+    @Test
+    void unifiedMigrationGrantsCustomerOperationsToPlatformAdmin() throws IOException {
+        Path repositoryRoot = Path.of(System.getProperty("maven.multiModuleProjectDirectory", ".."));
+        String sql = Files.readString(
+                repositoryRoot.resolve("deploy/sql/头程数据库统一增量-MySQL8.sql"),
+                StandardCharsets.UTF_8);
+        int grantStart = sql.indexOf("-- 新增平台操作权限默认只授予系统管理员。");
+        int grantEnd = sql.indexOf("-- 已有客户运营角色继续具备", grantStart);
+
+        assertThat(grantStart).isGreaterThanOrEqualTo(0);
+        assertThat(grantEnd).isGreaterThan(grantStart);
+        assertThat(sql.substring(grantStart, grantEnd))
+                .contains("'platform:customer:reset-password'")
+                .contains("'platform:customer:delete'")
+                .contains("'platform:customer:impersonate'");
+    }
 }