diff --git a/backend/migrations/20260318000000_add_permissioned_as.up.sql b/backend/migrations/20260318000000_add_permissioned_as.up.sql
index 51f8e97394..ae901077bd 100644
--- a/backend/migrations/20260318000000_add_permissioned_as.up.sql
+++ b/backend/migrations/20260318000000_add_permissioned_as.up.sql
@@ -4,51 +4,51 @@
 
 -- Trigger tables: add permissioned_as, drop email
 ALTER TABLE http_trigger ADD COLUMN permissioned_as VARCHAR(255);
-UPDATE http_trigger SET permissioned_as = CASE WHEN edited_by LIKE '%@%' THEN edited_by ELSE 'u/' || edited_by END;
+UPDATE http_trigger SET permissioned_as = CASE WHEN edited_by LIKE '%@%' THEN edited_by WHEN edited_by LIKE 'group-%' THEN 'g/' || substr(edited_by, 7) ELSE 'u/' || edited_by END;
 ALTER TABLE http_trigger ALTER COLUMN permissioned_as SET NOT NULL;
 ALTER TABLE http_trigger DROP COLUMN email;
 
 ALTER TABLE websocket_trigger ADD COLUMN permissioned_as VARCHAR(255);
-UPDATE websocket_trigger SET permissioned_as = CASE WHEN edited_by LIKE '%@%' THEN edited_by ELSE 'u/' || edited_by END;
+UPDATE websocket_trigger SET permissioned_as = CASE WHEN edited_by LIKE '%@%' THEN edited_by WHEN edited_by LIKE 'group-%' THEN 'g/' || substr(edited_by, 7) ELSE 'u/' || edited_by END;
 ALTER TABLE websocket_trigger ALTER COLUMN permissioned_as SET NOT NULL;
 ALTER TABLE websocket_trigger DROP COLUMN email;
 
 ALTER TABLE postgres_trigger ADD COLUMN permissioned_as VARCHAR(255);
-UPDATE postgres_trigger SET permissioned_as = CASE WHEN edited_by LIKE '%@%' THEN edited_by ELSE 'u/' || edited_by END;
+UPDATE postgres_trigger SET permissioned_as = CASE WHEN edited_by LIKE '%@%' THEN edited_by WHEN edited_by LIKE 'group-%' THEN 'g/' || substr(edited_by, 7) ELSE 'u/' || edited_by END;
 ALTER TABLE postgres_trigger ALTER COLUMN permissioned_as SET NOT NULL;
 ALTER TABLE postgres_trigger DROP COLUMN email;
 
 ALTER TABLE mqtt_trigger ADD COLUMN permissioned_as VARCHAR(255);
-UPDATE mqtt_trigger SET permissioned_as = CASE WHEN edited_by LIKE '%@%' THEN edited_by ELSE 'u/' || edited_by END;
+UPDATE mqtt_trigger SET permissioned_as = CASE WHEN edited_by LIKE '%@%' THEN edited_by WHEN edited_by LIKE 'group-%' THEN 'g/' || substr(edited_by, 7) ELSE 'u/' || edited_by END;
 ALTER TABLE mqtt_trigger ALTER COLUMN permissioned_as SET NOT NULL;
 ALTER TABLE mqtt_trigger DROP COLUMN email;
 
 ALTER TABLE kafka_trigger ADD COLUMN permissioned_as VARCHAR(255);
-UPDATE kafka_trigger SET permissioned_as = CASE WHEN edited_by LIKE '%@%' THEN edited_by ELSE 'u/' || edited_by END;
+UPDATE kafka_trigger SET permissioned_as = CASE WHEN edited_by LIKE '%@%' THEN edited_by WHEN edited_by LIKE 'group-%' THEN 'g/' || substr(edited_by, 7) ELSE 'u/' || edited_by END;
 ALTER TABLE kafka_trigger ALTER COLUMN permissioned_as SET NOT NULL;
 ALTER TABLE kafka_trigger DROP COLUMN email;
 
 ALTER TABLE nats_trigger ADD COLUMN permissioned_as VARCHAR(255);
-UPDATE nats_trigger SET permissioned_as = CASE WHEN edited_by LIKE '%@%' THEN edited_by ELSE 'u/' || edited_by END;
+UPDATE nats_trigger SET permissioned_as = CASE WHEN edited_by LIKE '%@%' THEN edited_by WHEN edited_by LIKE 'group-%' THEN 'g/' || substr(edited_by, 7) ELSE 'u/' || edited_by END;
 ALTER TABLE nats_trigger ALTER COLUMN permissioned_as SET NOT NULL;
 ALTER TABLE nats_trigger DROP COLUMN email;
 
 ALTER TABLE sqs_trigger ADD COLUMN permissioned_as VARCHAR(255);
-UPDATE sqs_trigger SET permissioned_as = CASE WHEN edited_by LIKE '%@%' THEN edited_by ELSE 'u/' || edited_by END;
+UPDATE sqs_trigger SET permissioned_as = CASE WHEN edited_by LIKE '%@%' THEN edited_by WHEN edited_by LIKE 'group-%' THEN 'g/' || substr(edited_by, 7) ELSE 'u/' || edited_by END;
 ALTER TABLE sqs_trigger ALTER COLUMN permissioned_as SET NOT NULL;
 ALTER TABLE sqs_trigger DROP COLUMN email;
 
 ALTER TABLE gcp_trigger ADD COLUMN permissioned_as VARCHAR(255);
-UPDATE gcp_trigger SET permissioned_as = CASE WHEN edited_by LIKE '%@%' THEN edited_by ELSE 'u/' || edited_by END;
+UPDATE gcp_trigger SET permissioned_as = CASE WHEN edited_by LIKE '%@%' THEN edited_by WHEN edited_by LIKE 'group-%' THEN 'g/' || substr(edited_by, 7) ELSE 'u/' || edited_by END;
 ALTER TABLE gcp_trigger ALTER COLUMN permissioned_as SET NOT NULL;
 ALTER TABLE gcp_trigger DROP COLUMN email;
 
 ALTER TABLE email_trigger ADD COLUMN permissioned_as VARCHAR(255);
-UPDATE email_trigger SET permissioned_as = CASE WHEN edited_by LIKE '%@%' THEN edited_by ELSE 'u/' || edited_by END;
+UPDATE email_trigger SET permissioned_as = CASE WHEN edited_by LIKE '%@%' THEN edited_by WHEN edited_by LIKE 'group-%' THEN 'g/' || substr(edited_by, 7) ELSE 'u/' || edited_by END;
 ALTER TABLE email_trigger ALTER COLUMN permissioned_as SET NOT NULL;
 ALTER TABLE email_trigger DROP COLUMN email;
 
 -- Schedule table: add permissioned_as, keep email for backwards compat with old workers
 ALTER TABLE schedule ADD COLUMN permissioned_as VARCHAR(255);
-UPDATE schedule SET permissioned_as = CASE WHEN edited_by LIKE '%@%' THEN edited_by ELSE 'u/' || edited_by END;
+UPDATE schedule SET permissioned_as = CASE WHEN edited_by LIKE '%@%' THEN edited_by WHEN edited_by LIKE 'group-%' THEN 'g/' || substr(edited_by, 7) ELSE 'u/' || edited_by END;
 ALTER TABLE schedule ALTER COLUMN permissioned_as SET NOT NULL;