diff --git a/kubernetes/clusters/1276-dev/databases/postgresql/app-externalsecrets.yaml b/kubernetes/clusters/1276-dev/databases/postgresql/app-externalsecrets.yaml
index 84e5f950..cb266b65 100644
--- a/kubernetes/clusters/1276-dev/databases/postgresql/app-externalsecrets.yaml
+++ b/kubernetes/clusters/1276-dev/databases/postgresql/app-externalsecrets.yaml
@@ -1,5 +1,6 @@
 ---
-# App-role passwords for the shared cluster's iris_app / dopamenu_app roles,
+# App-role passwords for the shared cluster's iris_app / dopamenu_app / plates_app
+# / notifications_app roles,
 # materialised into the `databases` namespace so `managed.roles.passwordSecret`
 # (cluster.yaml) can set them. type basic-auth + keys username/password +
 # cnpg.io/reload label are required by cnpg managed roles. The SAME Bitwarden
@@ -80,3 +81,28 @@ spec:
     - secretKey: password
       remoteRef:
         key: "e333d7be-e08f-4172-a5d1-b48000d5d01e"
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: notifications-db-app-credentials
+  namespace: databases
+spec:
+  refreshInterval: 24h
+  secretStoreRef:
+    name: bitwarden-secretsmanager
+    kind: ClusterSecretStore
+  target:
+    name: notifications-db-app-credentials
+    template:
+      type: kubernetes.io/basic-auth
+      metadata:
+        labels:
+          cnpg.io/reload: "true"
+      data:
+        username: notifications_app
+        password: "{{ .password }}"
+  data:
+    - secretKey: password
+      remoteRef:
+        key: "7015df9c-04a0-4034-96e4-b485016ae080"
diff --git a/kubernetes/clusters/1276-dev/databases/postgresql/cluster.yaml b/kubernetes/clusters/1276-dev/databases/postgresql/cluster.yaml
index 0d41f875..d50de405 100644
--- a/kubernetes/clusters/1276-dev/databases/postgresql/cluster.yaml
+++ b/kubernetes/clusters/1276-dev/databases/postgresql/cluster.yaml
@@ -54,7 +54,7 @@ spec:
     limits:
       memory: 512Mi
 
-  # iris + dopamenu + plates app roles (ADR-0018 consolidation). LOGIN NOSUPERUSER
+  # iris + dopamenu + plates + notifications app roles (ADR-0018 consolidation). LOGIN NOSUPERUSER
   # NOBYPASSRLS is the RLS invariant — the services connect as these roles; the
   # Flyway migrator connects as the cluster superuser `postgres`. Passwords come
   # from ESO-materialised secrets (app-externalsecrets.yaml) in this namespace.
@@ -93,3 +93,14 @@ spec:
         connectionLimit: -1
         passwordSecret:
           name: plates-db-app-credentials
+      - name: notifications_app
+        ensure: present
+        login: true
+        superuser: false
+        createdb: false
+        createrole: false
+        bypassrls: false
+        inherit: true
+        connectionLimit: -1
+        passwordSecret:
+          name: notifications-db-app-credentials
diff --git a/kubernetes/clusters/1276-dev/databases/postgresql/databases.yaml b/kubernetes/clusters/1276-dev/databases/postgresql/databases.yaml
index 47e769f4..31ec8d48 100644
--- a/kubernetes/clusters/1276-dev/databases/postgresql/databases.yaml
+++ b/kubernetes/clusters/1276-dev/databases/postgresql/databases.yaml
@@ -1,5 +1,6 @@
 ---
-# iris + dopamenu + plates databases on the shared `postgresql` cluster (ADR-0018).
+# iris + dopamenu + plates + notifications databases on the shared `postgresql`
+# cluster (ADR-0018).
 # databaseReclaimPolicy: retain => deleting the CR never drops the live database.
 apiVersion: postgresql.cnpg.io/v1
 kind: Database
@@ -36,3 +37,15 @@ spec:
   cluster:
     name: postgresql
   databaseReclaimPolicy: retain
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: notifications-database
+  namespace: databases
+spec:
+  name: notifications
+  owner: notifications_app
+  cluster:
+    name: postgresql
+  databaseReclaimPolicy: retain