diff --git a/modules/yc-database/main.tf b/modules/yc-database/main.tf
index 6154c31..1c67919 100644
--- a/modules/yc-database/main.tf
+++ b/modules/yc-database/main.tf
@@ -25,14 +25,21 @@ resource "yandex_mdb_postgresql_user" "this" {
   password   = random_password.user_password[each.key].result
   conn_limit = try(each.value.user.conn_limit, 10)
 
-  # permissions только для ДРУГИХ существующих БД
-  # на свою БД user получает права автоматически как owner
+  # Permission на свою БД + дополнительные permissions
+  # Yandex API требует явный permission даже для владельца
   dynamic "permission" {
-    for_each = distinct(compact(try(each.value.user.permissions, [])))
+    for_each = distinct(concat(
+      [each.value.database.name],
+      try(each.value.user.permissions, [])
+    ))
     content {
       database_name = permission.value
     }
   }
+
+  lifecycle {
+    ignore_changes = [password]
+  }
 }
 
 resource "yandex_mdb_postgresql_database" "this" {
diff --git a/scripts/generate-pipeline.sh b/scripts/generate-pipeline.sh
index b84d5d3..0a1f8ec 100755
--- a/scripts/generate-pipeline.sh
+++ b/scripts/generate-pipeline.sh
@@ -86,6 +86,15 @@ ${needs_section}
 
 VALIDATE_JOB
 
+  # Plan needs для secrets - ждём plan зависимостей
+  plan_needs="validate-${job_prefix}"
+  if [ "$component" = "secrets" ]; then
+    plan_needs="validate-${job_prefix}
+    - plan-${env}-namespace
+    - plan-${env}-s3
+    - plan-${env}-database"
+  fi
+
   cat >> "$OUTPUT_FILE" << PLAN_JOB
 plan-${job_prefix}:
   stage: plan
@@ -94,9 +103,8 @@ plan-${job_prefix}:
     TG_ROOT: "${full_component_dir}"
     ENVIRONMENT: "${env}"
     YC_FOLDER_ID: "\$${folder_var}"
-    TG_SKIP_DEPENDENCY_OUTPUTS: "true"
   needs:
-    - validate-${job_prefix}
+    - ${plan_needs}
   before_script:
     - cd \$TG_ROOT
     - ls -la