diff --git a/pb_migrations/1787000000_profile_max_rating.js b/pb_migrations/1787000000_profile_max_rating.js
new file mode 100644
index 0000000..02e935b
--- /dev/null
+++ b/pb_migrations/1787000000_profile_max_rating.js
@@ -0,0 +1,23 @@
+/// <reference path="../pb_data/types.d.ts" />
+
+// Per-profile content ceiling (issue #14 follow-up). Each profile may carry a
+// `maxRating` — one of the app's RatingTier tokens ("kids" | "twelve" |
+// "fifteen" | "unrestricted") — restricting which movies/TV it may browse and
+// play. Empty means "no explicit tier": the client falls back to the account's
+// default (a child profile resolves to "kids"). Stored as a plain text token,
+// opaque to the server (all filtering is client-side, like the kids filter);
+// keeping it a string, not an enum column, lets the app add tiers without a
+// further migration.
+migrate((app) => {
+  const profiles = app.findCollectionByNameOrId("profiles")
+  profiles.fields.add(new Field({
+    type: "text",
+    name: "maxRating",
+    max: 20,
+  }))
+  app.save(profiles)
+}, (app) => {
+  const profiles = app.findCollectionByNameOrId("profiles")
+  profiles.fields.removeByName("maxRating")
+  app.save(profiles)
+})