diff --git a/packages/db/migrations/0002_connected_services.sql b/packages/db/migrations/0002_connected_services.sql
index 5a02645..20ec004 100644
--- a/packages/db/migrations/0002_connected_services.sql
+++ b/packages/db/migrations/0002_connected_services.sql
@@ -65,11 +65,15 @@ BEGIN
     ALTER COLUMN status SET NOT NULL;
 
   -- 5. CHECK constraints. Drop-then-add for idempotency.
+  -- 'public' = credential-less public-profile connection (Komoot public
+  -- mode, api.sync.komoot.verify.ts). It was missing from the original
+  -- list, which made this migration fail against production data on
+  -- 2026-06-07 (a komoot public connection existed) and block cd-apps.
   ALTER TABLE journal.connected_services
     DROP CONSTRAINT IF EXISTS connected_services_credential_kind_check;
   ALTER TABLE journal.connected_services
     ADD CONSTRAINT connected_services_credential_kind_check
-    CHECK (credential_kind IN ('oauth', 'web-login', 'device'));
+    CHECK (credential_kind IN ('oauth', 'web-login', 'device', 'public'));
 
   ALTER TABLE journal.connected_services
     DROP CONSTRAINT IF EXISTS connected_services_status_check;
diff --git a/packages/db/src/schema/journal.ts b/packages/db/src/schema/journal.ts
index 546de41..3ed696e 100644
--- a/packages/db/src/schema/journal.ts
+++ b/packages/db/src/schema/journal.ts
@@ -224,6 +224,9 @@ export const oauthTokens = journalSchema.table("oauth_tokens", {
 //   - 'oauth':     { access_token, refresh_token, expires_at }
 //   - 'web-login': { email, encrypted_password, session_jar }   (Komoot, future)
 //   - 'device':    {}                                            (Apple Health, future)
+//   - 'public':    {}  credential-less public-profile connection (Komoot public mode)
+// Keep this list in sync with the CHECK constraint in
+// packages/db/migrations/0002_connected_services.sql.
 // See docs/adr/0001 and CONTEXT.md (Connected Services).
 export const connectedServices = journalSchema.table(
   "connected_services",