diff --git a/.forgejo/workflows/validate.yml b/.forgejo/workflows/validate.yml
index b12e563..3011a03 100644
--- a/.forgejo/workflows/validate.yml
+++ b/.forgejo/workflows/validate.yml
@@ -236,22 +236,26 @@ jobs:
           grep -q ' per_diem_rates ' /tmp/dt-after-up.txt
           grep -q ' agents ' /tmp/dt-after-up.txt
           grep -q ' agent_keys ' /tmp/dt-after-up.txt
+          grep -q ' approval_sessions ' /tmp/dt-after-up.txt
 
-      - name: migrate down 2 + verify only agent tables gone
+      # Roll back everything on top of per_diem_rates (0001) — currently
+      # 0004_approval_sessions, 0003_agent_keys, 0002_agents — and verify
+      # per_diem_rates remains while the agent-side tables are gone. Keep
+      # this count equal to the number of migrations above 0001; bump when
+      # a new migration is added.
+      - name: migrate down (all above per_diem_rates) + verify
         working-directory: ${{ github.workspace }}
         run: |
           set -euo pipefail
-          migrate -path db/trust/migrations -database "${DB_URL}" down 2
+          migrate -path db/trust/migrations -database "${DB_URL}" down 3
           psql "${DB_URL}" -c '\dt' | tee /tmp/dt-after-down.txt
           grep -q ' per_diem_rates ' /tmp/dt-after-down.txt
-          if grep -q ' agents ' /tmp/dt-after-down.txt; then
-            echo "FAIL: agents still present after migrate down 2" >&2
-            exit 1
-          fi
-          if grep -q ' agent_keys ' /tmp/dt-after-down.txt; then
-            echo "FAIL: agent_keys still present after migrate down 2" >&2
-            exit 1
-          fi
+          for table in agents agent_keys approval_sessions; do
+            if grep -q " ${table} " /tmp/dt-after-down.txt; then
+              echo "FAIL: ${table} still present after migrate down" >&2
+              exit 1
+            fi
+          done
 
       - name: migrate up (re-apply) + apply seed + verify three agents
         working-directory: ${{ github.workspace }}