diff --git a/pb_migrations/1793000000_releases_drop_adult_rule.js b/pb_migrations/1793000000_releases_drop_adult_rule.js
new file mode 100644
index 0000000..cc8b363
--- /dev/null
+++ b/pb_migrations/1793000000_releases_drop_adult_rule.js
@@ -0,0 +1,29 @@
+/// <reference path="../pb_data/types.d.ts" />
+
+// The `releases` read rule stops mentioning nsfwEnabled.
+//
+// It used to read:
+//   @request.auth.id != '' && (variant = 'clean' || @request.auth.nsfwEnabled = true)
+// — any signed-in account could read clean rows, and only an nsfwEnabled account
+// could read the 18+ ones. That clause was the thing keeping 18+ artifacts out of
+// reach of the family.
+//
+// Amber has no 18+ build any more and the nine rows that carried one (three
+// versions across three platforms, 437 MB) were deleted before this migration.
+// With nothing left for the clause to hide, it is a condition on a flag nothing
+// writes, which reads like a protection that is still doing something.
+//
+// `variant` itself stays on the collection and in the manifest: every installed
+// Amber compares that field against its own and refuses a mismatch silently.
+migrate((app) => {
+  const c = app.findCollectionByNameOrId("releases")
+  c.listRule = "@request.auth.id != ''"
+  c.viewRule = "@request.auth.id != ''"
+  app.save(c)
+}, (app) => {
+  const c = app.findCollectionByNameOrId("releases")
+  const rule = "@request.auth.id != '' && (variant = 'clean' || @request.auth.nsfwEnabled = true)"
+  c.listRule = rule
+  c.viewRule = rule
+  app.save(c)
+})