diff --git a/src/db.js b/src/db.js
index 095145b..6a030df 100644
--- a/src/db.js
+++ b/src/db.js
@@ -418,6 +418,43 @@ export async function initDb() {
       sort_order  = EXCLUDED.sort_order
   `)
 
+  // Seed hvac app + capabilities (no default Staff grants — admin assigns via portal).
+  // LXC 128 — 127 was already claimed by 'utilities' by the time this was built.
+  await pool.query(`
+    INSERT INTO apps (slug, name, description, base_path, icon, theme_color, category, internal_host, internal_port)
+    VALUES ('hvac', 'HVAC', 'Room heating control — NewBook-driven TRV scheduling, aircon and boiler (phased)', '/hvac', 'Thermometer', '#c1440e', 'Operations', '10.10.10.128', 3080)
+    ON CONFLICT (slug) DO UPDATE SET
+      name          = EXCLUDED.name,
+      description   = EXCLUDED.description,
+      base_path     = EXCLUDED.base_path,
+      icon          = EXCLUDED.icon,
+      theme_color   = EXCLUDED.theme_color,
+      category      = EXCLUDED.category,
+      internal_host = EXCLUDED.internal_host,
+      internal_port = EXCLUDED.internal_port
+  `)
+
+  await pool.query(`
+    INSERT INTO app_capabilities (app_id, slug, name, description, sort_order)
+    SELECT a.id, c.slug, c.name, c.description, c.sort_order
+    FROM apps a
+    CROSS JOIN (VALUES
+      ('view',                'View',                'View zone dashboard, device status and activity',            1),
+      ('control',             'Manual Override',      'Force a zone''s temperature and disable auto mode',          2),
+      ('schedule_edit',       'Edit Schedules',       'Adjust per-zone temps, offsets and auto mode',                3),
+      ('manage_devices',      'Manage Devices',       'Discover, map, photograph devices; sync zones from NewBook', 4),
+      ('public_area_control', 'Public Area Control',  'Central control of public-area zones (Phase 3)',              5),
+      ('boiler_view',         'Boiler — View',        'View boiler controller status (Phase 4)',                    6),
+      ('boiler_control',      'Boiler — Control',     'Adjust boiler weather-compensation / pump disable (Phase 4)',7),
+      ('settings',            'Settings',             'Configure hvac app settings',                                8)
+    ) AS c(slug, name, description, sort_order)
+    WHERE a.slug = 'hvac'
+    ON CONFLICT (app_id, slug) DO UPDATE SET
+      name        = EXCLUDED.name,
+      description = EXCLUDED.description,
+      sort_order  = EXCLUDED.sort_order
+  `)
+
   // Seed first admin user if table is empty
   const { rows } = await pool.query('SELECT COUNT(*) FROM users')
   if (parseInt(rows[0].count) === 0) {