diff --git a/crates/core/src/storage.rs b/crates/core/src/storage.rs
index 171758c..1500d02 100644
--- a/crates/core/src/storage.rs
+++ b/crates/core/src/storage.rs
@@ -287,7 +287,10 @@ impl Storage {
                 canonical_root_post_id BLOB
             );
             CREATE INDEX IF NOT EXISTS idx_group_keys_circle ON group_keys(circle_name);
-            CREATE INDEX IF NOT EXISTS idx_group_keys_root ON group_keys(canonical_root_post_id);
+            -- idx_group_keys_root is created in the migration block below, after
+            -- ALTER TABLE has ensured the canonical_root_post_id column exists
+            -- on upgraded DBs (CREATE TABLE IF NOT EXISTS is a no-op against an
+            -- older schema, so the column may still be missing at this point).
             CREATE TABLE IF NOT EXISTS group_member_keys (
                 group_id BLOB NOT NULL,
                 member BLOB NOT NULL,
@@ -658,10 +661,18 @@ impl Storage {
         )?.query_row([], |row| row.get::<_, i64>(0))?;
         if has_canonical_root == 0 {
             self.conn.execute_batch(
-                "ALTER TABLE group_keys ADD COLUMN canonical_root_post_id BLOB DEFAULT NULL;
-                 CREATE INDEX IF NOT EXISTS idx_group_keys_root ON group_keys(canonical_root_post_id);"
+                "ALTER TABLE group_keys ADD COLUMN canonical_root_post_id BLOB DEFAULT NULL;"
             )?;
         }
+        // Ensure the root-lookup index exists on every startup. IF NOT EXISTS
+        // makes this idempotent; runs for both fresh DBs (where CREATE TABLE
+        // above populated the column) and just-upgraded DBs (where the ALTER
+        // above did). Before this fix, the index was inlined in the CREATE
+        // TABLE block and tried to reference a column that didn't exist yet
+        // on upgrading DBs.
+        self.conn.execute_batch(
+            "CREATE INDEX IF NOT EXISTS idx_group_keys_root ON group_keys(canonical_root_post_id);"
+        )?;
 
         // Add device_role column to peers if missing (Active CDN replication)
         let has_device_role = self.conn.prepare(