diff --git a/backend/users/migrations/0002_user_kdf_salt_alter_user_is_active.py b/backend/users/migrations/0002_user_kdf_salt_alter_user_is_active.py
new file mode 100644
index 0000000..3f741db
--- /dev/null
+++ b/backend/users/migrations/0002_user_kdf_salt_alter_user_is_active.py
@@ -0,0 +1,22 @@
+# Generated by Django 6.0.4 on 2026-04-10 04:48
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("users", "0001_initial"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="user",
+            name="kdf_salt",
+            field=models.CharField(blank=True, max_length=128, null=True),
+        ),
+        migrations.AlterField(
+            model_name="user",
+            name="is_active",
+            field=models.BooleanField(default=False),
+        ),
+    ]
diff --git a/backend/users/models.py b/backend/users/models.py
index fb0fb8a..fbdd650 100644
--- a/backend/users/models.py
+++ b/backend/users/models.py
@@ -41,6 +41,8 @@ class User(AbstractUser):
 
     full_name = models.CharField(max_length=100)
     email = models.EmailField(_("email address"), unique=True)
+
+    # salt for client-side key derivation
     kdf_salt = models.CharField(max_length=128, blank=True, null=True)
 
     # Default is False to enforce email verification