diff --git a/deploy/replicas.env.example b/deploy/replicas.env.example
index 613ff4d..27e2f82 100644
--- a/deploy/replicas.env.example
+++ b/deploy/replicas.env.example
@@ -7,8 +7,8 @@
 REPLICA_DSNS="postgresql://USER:PASSWORD@SLAVE_1_IP:5433/superadmin
 postgresql://USER:PASSWORD@SLAVE_2_IP:5432/superadmin"
 
-# Read-only app user on replicas (program-settings API). Grants re-applied after data repair.
-# REPLICA_APP_DB_USER=montime
+# Replication user that subscribers use to COPY from this publisher (must SELECT every table).
+# REPL_PUBLISHER_USER=repl_user
 
 # Optional. If TCP 127.0.0.1:15432 is refused, omit this — the script falls back
 # to unix socket / `runuser -u postgres` on port 15432.
diff --git a/deploy/sync-replica-data.sh b/deploy/sync-replica-data.sh
index cff14b7..07715fc 100644
--- a/deploy/sync-replica-data.sh
+++ b/deploy/sync-replica-data.sh
@@ -188,6 +188,21 @@ publisher_dump() {
 
 connect_publisher
 
+REPL_PUBLISHER_USER="${REPL_PUBLISHER_USER:-repl_user}"
+
+grant_publisher_repl_user() {
+  echo "publisher: GRANT SELECT on all tables to ${REPL_PUBLISHER_USER}"
+  publisher_psql -v ON_ERROR_STOP=1 -q -c "
+    GRANT USAGE ON SCHEMA public TO ${REPL_PUBLISHER_USER};
+    GRANT SELECT ON ALL TABLES IN SCHEMA public TO ${REPL_PUBLISHER_USER};
+    GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO ${REPL_PUBLISHER_USER};
+    ALTER DEFAULT PRIVILEGES IN SCHEMA public
+      GRANT SELECT ON TABLES TO ${REPL_PUBLISHER_USER};
+  " || true
+}
+
+grant_publisher_repl_user
+
 table_count() {
   local dsn="$1" table="$2"
   if [[ "$dsn" == "$PUBLISHER" ]]; then