diff --git a/Dockerfile b/Dockerfile
index 52e2de875..a991ab71d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -35,7 +35,7 @@ ARG wrappers_release=0.3.0
 ARG hypopg_release=1.3.1
 ARG pgvector_release=0.4.0
 ARG pg_tle_release=1.3.2
-ARG supautils_release=2.1.0
+ARG supautils_release=2.2.0
 ARG wal_g_release=2.0.1
 
 ####################
diff --git a/ansible/files/postgresql_config/supautils.conf.j2 b/ansible/files/postgresql_config/supautils.conf.j2
index 77b93a3ac..f192d94e5 100644
--- a/ansible/files/postgresql_config/supautils.conf.j2
+++ b/ansible/files/postgresql_config/supautils.conf.j2
@@ -1,4 +1,5 @@
 supautils.extensions_parameter_overrides = '{"pg_cron":{"schema":"pg_catalog"}}'
+supautils.policy_grants = '{"postgres":["auth.audit_log_entries","auth.identities","auth.refresh_tokens","auth.sessions","auth.users","realtime.broadcasts","realtime.channels","realtime.presences","storage.buckets","storage.migrations","storage.objects"]}'
 # full list:                                 address_standardizer, address_standardizer_data_us, adminpack, amcheck, autoinc, bloom, btree_gin, btree_gist, citext, cube, dblink, dict_int, dict_xsyn, earthdistance, file_fdw, fuzzystrmatch, hstore, http, hypopg, insert_username, intagg, intarray, isn, lo, ltree, moddatetime, old_snapshot, orioledb, pageinspect, pg_buffercache, pg_cron, pg_freespacemap, pg_graphql, pg_hashids, pg_jsonschema, pg_net, pg_prewarm, pg_repack, pg_stat_monitor, pg_stat_statements, pg_surgery, pg_tle, pg_trgm, pg_visibility, pg_walinspect, pgaudit, pgcrypto, pgjwt, pgroonga, pgroonga_database, pgrouting, pgrowlocks, pgsodium, pgstattuple, pgtap, plcoffee, pljava, plls, plpgsql, plpgsql_check, plv8, postgis, postgis_raster, postgis_sfcgal, postgis_tiger_geocoder, postgis_topology, postgres_fdw, refint, rum, seg, sslinfo, supabase_vault, supautils, tablefunc, tcn, timescaledb, tsm_system_rows, tsm_system_time, unaccent, uuid-ossp, vector, wrappers, xml2
 # omitted because may be unsafe:             adminpack, amcheck, file_fdw, lo, old_snapshot, pageinspect, pg_buffercache, pg_freespacemap, pg_surgery, pg_visibility
 # omitted because deprecated:                intagg, xml2
diff --git a/ansible/vars.yml b/ansible/vars.yml
index 9b4646db7..28c6c9590 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -82,8 +82,8 @@ timescaledb_release_checksum: sha256:883638f2e79d25ec88ee58f603f3c81c999b6364cb4
 wal2json_release: "2_5"
 wal2json_release_checksum: sha256:b516653575541cf221b99cf3f8be9b6821f6dbcfc125675c85f35090f824f00e
 
-supautils_release: "2.1.0"
-supautils_release_checksum: sha256:a84056d3e200710f6a547e0f7b88910420ddfe7fe06b6fa7bafa9b0598d13fee
+supautils_release: "2.2.0"
+supautils_release_checksum: sha256:0019dfc4b32d63c1392aa264aed2253c1e0c2fb09216f8e2cc269bbfb8bb49b5
 
 pljava_release: master
 pljava_release_checksum: sha256:e99b1c52f7b57f64c8986fe6ea4a6cc09d78e779c1643db060d0ac66c93be8b6
diff --git a/common.vars.pkr.hcl b/common.vars.pkr.hcl
index 62348aafc..278fa6ec0 100644
--- a/common.vars.pkr.hcl
+++ b/common.vars.pkr.hcl
@@ -1,2 +1 @@
-postgres-version = "15.1.1.38"
-
+postgres-version = "15.1.1.39"
diff --git a/docker/orioledb/Dockerfile b/docker/orioledb/Dockerfile
index 494ffff4c..a333e26b8 100644
--- a/docker/orioledb/Dockerfile
+++ b/docker/orioledb/Dockerfile
@@ -35,7 +35,7 @@ ARG wrappers_release=0.2.0
 ARG hypopg_release=1.3.1
 ARG pgvector_release=0.4.0
 ARG pg_tle_release=1.3.2
-ARG supautils_release=2.1.0
+ARG supautils_release=2.2.0
 ARG wal_g_release=2.0.1
 
 ####################
diff --git a/nix/ext/supautils.nix b/nix/ext/supautils.nix
index 7b11ebf49..eaf772766 100644
--- a/nix/ext/supautils.nix
+++ b/nix/ext/supautils.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "supautils";
-  version = "2.1.0";
+  version = "2.2.0";
 
   buildInputs = [ postgresql ];
 
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     owner = "supabase";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-AKb8P+TvVRqw9pQhYka6rGzmcw5S1jpIZYH2kMisqyc=";
+    hash = "sha256-LEMhUM0woTwRcSWOU70izS5eWevoV8nnMUOEID+Nsdc=";
   };
 
   installPhase = ''