diff --git a/docker/seed-sites.sh b/docker/seed-sites.sh
index fa5c7102..2d2bc8eb 100755
--- a/docker/seed-sites.sh
+++ b/docker/seed-sites.sh
@@ -96,7 +96,7 @@ for ident in site-a site-b site-c; do
 done
 
 echo ""
-echo "Seeding LDAP group mappings (Design + Deployment)..."
+echo "Seeding LDAP group mappings (Designer + Deployer)..."
 # SecurityConfiguration.HasData declares 4 mappings but the InitialSchema
 # migration only inserts the Admin row, so a fresh ScadaBridgeConfig starts
 # with multi-role getting Admin only -- no Design and no Deployment access.
@@ -106,11 +106,16 @@ docker exec -i scadabridge-mssql /opt/mssql-tools18/bin/sqlcmd \
     -d ScadaBridgeConfig -Q "
 SET IDENTITY_INSERT LdapGroupMappings ON;
 IF NOT EXISTS (SELECT 1 FROM LdapGroupMappings WHERE Id = 2)
-    INSERT INTO LdapGroupMappings (Id, LdapGroupName, Role) VALUES (2, 'SCADA-Designers', 'Design');
+    INSERT INTO LdapGroupMappings (Id, LdapGroupName, Role) VALUES (2, 'SCADA-Designers', 'Designer');
 IF NOT EXISTS (SELECT 1 FROM LdapGroupMappings WHERE Id = 3)
-    INSERT INTO LdapGroupMappings (Id, LdapGroupName, Role) VALUES (3, 'SCADA-Deploy-All', 'Deployment');
+    INSERT INTO LdapGroupMappings (Id, LdapGroupName, Role) VALUES (3, 'SCADA-Deploy-All', 'Deployer');
 IF NOT EXISTS (SELECT 1 FROM LdapGroupMappings WHERE Id = 4)
-    INSERT INTO LdapGroupMappings (Id, LdapGroupName, Role) VALUES (4, 'SCADA-Deploy-SiteA', 'Deployment');
+    INSERT INTO LdapGroupMappings (Id, LdapGroupName, Role) VALUES (4, 'SCADA-Deploy-SiteA', 'Deployer');
+-- Role strings MUST match the canonical vocabulary in
+-- src/ZB.MOM.WW.ScadaBridge.Security/Roles.cs ('Designer' / 'Deployer').
+-- These rows previously carried the pre-rename 'Design' / 'Deployment', which
+-- authorized nothing: every Designer/Deployer-gated management command failed
+-- UNAUTHORIZED on a freshly reseeded rig.
 SET IDENTITY_INSERT LdapGroupMappings OFF;
 "