diff --git a/internal/db/migrations/0003_subsonic_password.up.sql b/internal/db/migrations/0003_subsonic_password.up.sql
new file mode 100644
index 00000000..304e0192
--- /dev/null
+++ b/internal/db/migrations/0003_subsonic_password.up.sql
@@ -0,0 +1,7 @@
+-- Subsonic's token auth (t = md5(password + salt)) requires the server to
+-- compute md5 over the user's plaintext password. bcrypt (password_hash) is
+-- not reversible, so we store a *separate*, opt-in, plaintext credential used
+-- exclusively for the /rest/* legacy auth path. NULL means the user has not
+-- opted into Subsonic t/s auth and must use apiKey (OpenSubsonic) instead.
+
+ALTER TABLE users ADD COLUMN subsonic_password text;