diff --git a/internal/store/migrations/032_permission_indexes.sql b/internal/store/migrations/032_permission_indexes.sql
new file mode 100644
index 00000000..3f0c74e7
--- /dev/null
+++ b/internal/store/migrations/032_permission_indexes.sql
@@ -0,0 +1,10 @@
+-- Indexes for permission table query performance (TASK-486).
+
+-- member_collection_access: reverse lookup by collection (for cascade cleanup on collection delete)
+CREATE INDEX IF NOT EXISTS idx_mca_collection ON member_collection_access(collection_id);
+
+-- collections: fast lookup of system collections per workspace
+CREATE INDEX IF NOT EXISTS idx_collections_system ON collections(workspace_id, is_system) WHERE is_system = 1 AND deleted_at IS NULL;
+
+-- workspace_members: fast lookup by user across workspaces (for user deletion cascade)
+CREATE INDEX IF NOT EXISTS idx_wm_user ON workspace_members(user_id);
diff --git a/internal/store/pgmigrations/012_permission_indexes.sql b/internal/store/pgmigrations/012_permission_indexes.sql
new file mode 100644
index 00000000..17b2a552
--- /dev/null
+++ b/internal/store/pgmigrations/012_permission_indexes.sql
@@ -0,0 +1,5 @@
+-- Indexes for permission table query performance (TASK-486).
+
+CREATE INDEX IF NOT EXISTS idx_mca_collection ON member_collection_access(collection_id);
+CREATE INDEX IF NOT EXISTS idx_collections_system ON collections(workspace_id, is_system) WHERE is_system = TRUE AND deleted_at IS NULL;
+CREATE INDEX IF NOT EXISTS idx_wm_user ON workspace_members(user_id);
diff --git a/internal/store/store.go b/internal/store/store.go
index 9a62c4dd..37480b85 100644
--- a/internal/store/store.go
+++ b/internal/store/store.go
@@ -156,6 +156,7 @@ func (s *Store) migrate() error {
 		"029_username.sql",
 		"030_workspace_owner.sql",
 		"031_collection_access.sql",
+		"032_permission_indexes.sql",
 	}
 
 	for _, name := range migrations {
@@ -211,6 +212,7 @@ func (s *Store) migratePostgres() error {
 		"009_username.sql",
 		"010_workspace_owner.sql",
 		"011_collection_access.sql",
+		"012_permission_indexes.sql",
 	}
 
 	for _, name := range migrations {