diff --git a/infrastructure/modules/postgres-app/job.yaml b/infrastructure/modules/postgres-app/job.yaml
index e747087..78b4f31 100644
--- a/infrastructure/modules/postgres-app/job.yaml
+++ b/infrastructure/modules/postgres-app/job.yaml
@@ -43,6 +43,7 @@ spec:
         - -c
         - |
           psql <<EOF
+          -- Create user (safe in transaction)
           DO \$\$
           BEGIN
             IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = '${APP_USER}') THEN
@@ -51,13 +52,12 @@ spec:
           END
           \$\$;
 
-          DO \$\$
-          BEGIN
-            IF NOT EXISTS (SELECT FROM pg_database WHERE datname = '${APP_DB}') THEN
-              CREATE DATABASE ${APP_DB} OWNER ${APP_USER};
-            END IF;
-          END
-          \$\$;
+          -- Create database (must be outside transaction)
+          SELECT 'CREATE DATABASE ${APP_DB} OWNER ${APP_USER}'
+          WHERE NOT EXISTS (
+            SELECT FROM pg_database WHERE datname = '${APP_DB}'
+          )\gexec
 
+          -- Grant privileges (safe)
           GRANT ALL PRIVILEGES ON DATABASE ${APP_DB} TO ${APP_USER};
           EOF