diff --git a/rawsql.go b/rawsql.go
index f1de8fd..ac92015 100644
--- a/rawsql.go
+++ b/rawsql.go
@@ -36,6 +36,7 @@ func isRawSQLAllowed(path string) bool {
 var allowedSQLPatterns = []string{
 	"pg_terminate_backend", // backup_service.go — kills connections before restore
 	"FROM pg_database",     // Administrative catalog lookup for tenant database existence
+	"FROM pg_roles",        // role_provisioner.go — per-plugin role existence lookup (DCL, not sqlc-able)
 }
 
 func isSQLAllowed(sql string) bool {