diff --git a/src/integrations/supabase/types.ts b/src/integrations/supabase/types.ts
index 5766cc8..14c8b74 100644
--- a/src/integrations/supabase/types.ts
+++ b/src/integrations/supabase/types.ts
@@ -632,6 +632,23 @@ export type Database = {
         Args: { check_env?: string; user_uuid: string }
         Returns: boolean
       }
+      vault_create_secret: {
+        Args: {
+          secret_description?: string
+          secret_name: string
+          secret_value: string
+        }
+        Returns: {
+          secret_id: string
+        }[]
+      }
+      vault_decrypt_secret: {
+        Args: { secret_id: string }
+        Returns: {
+          decrypted_secret: string
+        }[]
+      }
+      vault_delete_secret: { Args: { secret_id: string }; Returns: undefined }
     }
     Enums: {
       [_ in never]: never
diff --git a/supabase/migrations/20260417195755_b341c835-f177-4c9f-a114-641c72aa6022.sql b/supabase/migrations/20260417195755_b341c835-f177-4c9f-a114-641c72aa6022.sql
new file mode 100644
index 0000000..bf62da8
--- /dev/null
+++ b/supabase/migrations/20260417195755_b341c835-f177-4c9f-a114-641c72aa6022.sql
@@ -0,0 +1,52 @@
+-- Wrappers para o Supabase Vault, executáveis apenas pelo service_role
+-- (usados pelas Edge Functions Telegram para guardar tokens com criptografia).
+
+CREATE OR REPLACE FUNCTION public.vault_create_secret(
+  secret_value text,
+  secret_name text,
+  secret_description text DEFAULT ''
+)
+RETURNS TABLE(secret_id uuid)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public, vault
+AS $$
+BEGIN
+  RETURN QUERY
+  SELECT vault.create_secret(secret_value, secret_name, secret_description);
+END;
+$$;
+
+REVOKE ALL ON FUNCTION public.vault_create_secret(text, text, text) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.vault_create_secret(text, text, text) TO service_role;
+
+CREATE OR REPLACE FUNCTION public.vault_decrypt_secret(secret_id uuid)
+RETURNS TABLE(decrypted_secret text)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public, vault
+AS $$
+BEGIN
+  RETURN QUERY
+  SELECT ds.decrypted_secret
+  FROM vault.decrypted_secrets ds
+  WHERE ds.id = secret_id;
+END;
+$$;
+
+REVOKE ALL ON FUNCTION public.vault_decrypt_secret(uuid) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.vault_decrypt_secret(uuid) TO service_role;
+
+CREATE OR REPLACE FUNCTION public.vault_delete_secret(secret_id uuid)
+RETURNS void
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public, vault
+AS $$
+BEGIN
+  DELETE FROM vault.secrets WHERE id = secret_id;
+END;
+$$;
+
+REVOKE ALL ON FUNCTION public.vault_delete_secret(uuid) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.vault_delete_secret(uuid) TO service_role;
\ No newline at end of file