diff --git a/scripts/migrate_provider_columns.sql b/scripts/migrate_provider_columns.sql
new file mode 100644
index 0000000..1e3b4b6
--- /dev/null
+++ b/scripts/migrate_provider_columns.sql
@@ -0,0 +1,67 @@
+-- Rename legacy IdP column names to provider_* naming.
+-- Safe to run multiple times.
+
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM information_schema.columns
+    WHERE table_schema = 'public' AND table_name = 'companies' AND column_name = 'idp_group_id'
+  ) AND NOT EXISTS (
+    SELECT 1 FROM information_schema.columns
+    WHERE table_schema = 'public' AND table_name = 'companies' AND column_name = 'provider_group_id'
+  ) THEN
+    ALTER TABLE public.companies RENAME COLUMN idp_group_id TO provider_group_id;
+  END IF;
+END $$;
+
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM information_schema.columns
+    WHERE table_schema = 'public' AND table_name = 'sites' AND column_name = 'idp_group_id'
+  ) AND NOT EXISTS (
+    SELECT 1 FROM information_schema.columns
+    WHERE table_schema = 'public' AND table_name = 'sites' AND column_name = 'provider_group_id'
+  ) THEN
+    ALTER TABLE public.sites RENAME COLUMN idp_group_id TO provider_group_id;
+  END IF;
+END $$;
+
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM information_schema.columns
+    WHERE table_schema = 'public' AND table_name = 'systems' AND column_name = 'idp_client_id'
+  ) AND NOT EXISTS (
+    SELECT 1 FROM information_schema.columns
+    WHERE table_schema = 'public' AND table_name = 'systems' AND column_name = 'provider_client_id'
+  ) THEN
+    ALTER TABLE public.systems RENAME COLUMN idp_client_id TO provider_client_id;
+  END IF;
+END $$;
+
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM information_schema.columns
+    WHERE table_schema = 'public' AND table_name = 'roles' AND column_name = 'idp_role_name'
+  ) AND NOT EXISTS (
+    SELECT 1 FROM information_schema.columns
+    WHERE table_schema = 'public' AND table_name = 'roles' AND column_name = 'provider_role_name'
+  ) THEN
+    ALTER TABLE public.roles RENAME COLUMN idp_role_name TO provider_role_name;
+  END IF;
+END $$;
+
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM information_schema.columns
+    WHERE table_schema = 'public' AND table_name = 'users' AND column_name = 'idp_user_id'
+  ) AND NOT EXISTS (
+    SELECT 1 FROM information_schema.columns
+    WHERE table_schema = 'public' AND table_name = 'users' AND column_name = 'provider_user_id'
+  ) THEN
+    ALTER TABLE public.users RENAME COLUMN idp_user_id TO provider_user_id;
+  END IF;
+END $$;