diff --git a/src/db.js b/src/db.js
index 180ea13..400748d 100644
--- a/src/db.js
+++ b/src/db.js
@@ -352,6 +352,38 @@ export async function initDb() {
     ON CONFLICT DO NOTHING
   `)
 
+  // Seed wages app + capabilities (management/finance only — no default Staff grants)
+  await pool.query(`
+    INSERT INTO apps (slug, name, description, base_path, icon, theme_color, category, internal_host, internal_port)
+    VALUES ('wages', 'Wage Costs', 'Live wage cost reporting — weekly, monthly, and rolling history vs budget and net sales', '/wages', 'DollarSign', '#065f46', 'Finance', '10.10.10.124', 3080)
+    ON CONFLICT (slug) DO UPDATE SET
+      name          = EXCLUDED.name,
+      description   = EXCLUDED.description,
+      base_path     = EXCLUDED.base_path,
+      icon          = EXCLUDED.icon,
+      theme_color   = EXCLUDED.theme_color,
+      category      = EXCLUDED.category,
+      internal_host = EXCLUDED.internal_host,
+      internal_port = EXCLUDED.internal_port
+  `)
+
+  await pool.query(`
+    INSERT INTO app_capabilities (app_id, slug, name, description, sort_order)
+    SELECT a.id, c.slug, c.name, c.description, c.sort_order
+    FROM apps a
+    CROSS JOIN (VALUES
+      ('view',     'View Reports',    'View all wage cost reports (weekly, monthly, rolling)',  1),
+      ('budget',   'Edit Budgets',    'Set monthly wage budget targets',                        2),
+      ('sync',     'Manual Sync',     'Trigger a Workforce API data sync or backfill',          3),
+      ('settings', 'Settings',        'App settings, API configuration and department filter',  4)
+    ) AS c(slug, name, description, sort_order)
+    WHERE a.slug = 'wages'
+    ON CONFLICT (app_id, slug) DO UPDATE SET
+      name        = EXCLUDED.name,
+      description = EXCLUDED.description,
+      sort_order  = EXCLUDED.sort_order
+  `)
+
   // Seed first admin user if table is empty
   const { rows } = await pool.query('SELECT COUNT(*) FROM users')
   if (parseInt(rows[0].count) === 0) {