diff --git a/docs/src/content/docs/operations/upgrades.mdx b/docs/src/content/docs/operations/upgrades.mdx
index 011665e9..ca570666 100644
--- a/docs/src/content/docs/operations/upgrades.mdx
+++ b/docs/src/content/docs/operations/upgrades.mdx
@@ -207,6 +207,16 @@ A restore to before the upgrade loses the audit events written since; see
 
 ## Release Notes That Need Action
 
+### `users.suspended` dropped (v0.1.12)
+
+This release's migration drops the unused `users.suspended` column. v0.1.10 and earlier still read it, so they
+can't load users once you've migrated.
+
+1. **Upgrade through v0.1.11 first.** Migrations run before the promote, while the old release is still serving
+   (see [Zero-Downtime Upgrades](#zero-downtime-upgrades)), and only v0.1.11 or later keeps working against the new
+   schema.
+2. **Don't roll back past v0.1.11** after migrating.
+
 ### Anchor bucket retention checked at startup (v0.1.11)
 
 `AUDIT_ANCHOR_RETENTION_DAYS` is now checked: the gateway reads the anchor bucket's Object Lock configuration at
diff --git a/internal/gateway/db/migrations/20261016000000_drop_users_suspended.sql b/internal/gateway/db/migrations/20261016000000_drop_users_suspended.sql
new file mode 100644
index 00000000..d6b02feb
--- /dev/null
+++ b/internal/gateway/db/migrations/20261016000000_drop_users_suspended.sql
@@ -0,0 +1,3 @@
+-- Locking a user (locked_at) is how an account is disabled. Nothing has read or written suspended since v0.1.11,
+-- which shipped with the column still in place so v0.1.10 could keep running during that rollout.
+ALTER TABLE users DROP COLUMN IF EXISTS suspended;