diff --git a/fineract-provider/src/main/resources/db/changelog/tenant/final-changelog-tenant.xml b/fineract-provider/src/main/resources/db/changelog/tenant/final-changelog-tenant.xml
index 15554ba53..02bfb8312 100644
--- a/fineract-provider/src/main/resources/db/changelog/tenant/final-changelog-tenant.xml
+++ b/fineract-provider/src/main/resources/db/changelog/tenant/final-changelog-tenant.xml
@@ -69,4 +69,9 @@
     <include file="parts/0540_unique_active_cash_settlement_per_cashier_day.xml" relativeToChangelogFile="true"/>
     <include file="parts/0541_create_tenant_menu_access.xml" relativeToChangelogFile="true"/>
     <include file="parts/0542_split_loan_origination_investment_permissions.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0543_remove_unused_roles_and_merge_manager_roles.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0544_catchup_teller_is_deleted.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0545_catchup_current_account_columns.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0546_rename_cashier_role_to_title_case.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0547_revoke_all_functions_from_clerk.xml" relativeToChangelogFile="true"/>
 </databaseChangeLog>
diff --git a/fineract-provider/src/main/resources/db/changelog/tenant/parts/0543_remove_unused_roles_and_merge_manager_roles.xml b/fineract-provider/src/main/resources/db/changelog/tenant/parts/0543_remove_unused_roles_and_merge_manager_roles.xml
new file mode 100644
index 000000000..881b798cf
--- /dev/null
+++ b/fineract-provider/src/main/resources/db/changelog/tenant/parts/0543_remove_unused_roles_and_merge_manager_roles.xml
@@ -0,0 +1,60 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
+        http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.1.xsd">
+
+    <!-- 'Self Service User' was audited across every tenant and found with zero users assigned
+         anywhere and no wired-up purpose. Principal Officer is kept - it is the statutory
+         PMLA/RBI compliance seat added in 0435, just not yet assigned to anyone. -->
+    <changeSet id="0543-1" author="cbs-nitesh">
+        <sql>
+            DELETE FROM m_role_permission
+             WHERE role_id IN (SELECT id FROM m_role WHERE name = 'Self Service User')
+        </sql>
+        <sql>
+            DELETE FROM m_appuser_role
+             WHERE role_id IN (SELECT id FROM m_role WHERE name = 'Self Service User')
+        </sql>
+        <sql>
+            DELETE FROM m_role WHERE name = 'Self Service User'
+        </sql>
+    </changeSet>
+
+    <!-- 'As Manager' and 'Branch Manager' covered overlapping ground (loan/cash operations vs.
+         portfolio/savings operations). Merging them into one surviving role - 'Branch Manager' -
+         rather than just keeping both in sync: Branch Manager first picks up any permission only
+         As Manager had, then As Manager's users move onto Branch Manager, then As Manager itself
+         is removed. -->
+    <changeSet id="0543-2" author="cbs-nitesh">
+        <sql>
+            INSERT INTO m_role_permission (role_id, permission_id)
+            SELECT (SELECT id FROM m_role WHERE name = 'Branch Manager'), rp.permission_id
+              FROM m_role_permission rp
+             WHERE rp.role_id = (SELECT id FROM m_role WHERE name = 'As Manager')
+               AND NOT EXISTS (
+                     SELECT 1 FROM m_role_permission existing
+                      WHERE existing.role_id = (SELECT id FROM m_role WHERE name = 'Branch Manager')
+                        AND existing.permission_id = rp.permission_id)
+        </sql>
+        <sql>
+            INSERT INTO m_appuser_role (appuser_id, role_id)
+            SELECT ur.appuser_id, (SELECT id FROM m_role WHERE name = 'Branch Manager')
+              FROM m_appuser_role ur
+             WHERE ur.role_id = (SELECT id FROM m_role WHERE name = 'As Manager')
+               AND NOT EXISTS (
+                     SELECT 1 FROM m_appuser_role existing
+                      WHERE existing.appuser_id = ur.appuser_id
+                        AND existing.role_id = (SELECT id FROM m_role WHERE name = 'Branch Manager'))
+        </sql>
+        <sql>
+            DELETE FROM m_appuser_role WHERE role_id = (SELECT id FROM m_role WHERE name = 'As Manager')
+        </sql>
+        <sql>
+            DELETE FROM m_role_permission WHERE role_id = (SELECT id FROM m_role WHERE name = 'As Manager')
+        </sql>
+        <sql>
+            DELETE FROM m_role WHERE name = 'As Manager'
+        </sql>
+    </changeSet>
+</databaseChangeLog>
diff --git a/fineract-provider/src/main/resources/db/changelog/tenant/parts/0546_rename_cashier_role_to_title_case.xml b/fineract-provider/src/main/resources/db/changelog/tenant/parts/0546_rename_cashier_role_to_title_case.xml
new file mode 100644
index 000000000..b2ffb76e2
--- /dev/null
+++ b/fineract-provider/src/main/resources/db/changelog/tenant/parts/0546_rename_cashier_role_to_title_case.xml
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
+        http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.1.xsd">
+
+    <!-- Every other role reads in title case ('Clerk', 'Teller', 'Branch Manager'); 'CASHIER' was
+         the one seeded in all caps, which is what showed up as an all-caps chip in the user-role
+         picker. Role name is only ever matched case-insensitively (CashierRoleHelper.isCashierOnly,
+         validateCheckerRole), so this rename changes nothing about who counts as a cashier. -->
+    <changeSet id="0546-1" author="cbs-nitesh">
+        <sql>
+            UPDATE m_role SET name = 'Cashier' WHERE name = 'CASHIER'
+        </sql>
+    </changeSet>
+</databaseChangeLog>
diff --git a/fineract-provider/src/main/resources/db/changelog/tenant/parts/0547_revoke_all_functions_from_clerk.xml b/fineract-provider/src/main/resources/db/changelog/tenant/parts/0547_revoke_all_functions_from_clerk.xml
new file mode 100644
index 000000000..519b7261a
--- /dev/null
+++ b/fineract-provider/src/main/resources/db/changelog/tenant/parts/0547_revoke_all_functions_from_clerk.xml
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
+        http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.1.xsd">
+
+    <!-- Clerk somehow carried ALL_FUNCTIONS, which bypasses every individual permission check
+         (HasPermissionDirective, and this table's own role-permission rows) unconditionally - a
+         Clerk should only ever have the specific request/submit rights this role's own explicit
+         permission rows already grant, never full access. Revoking just that one row; Clerk's
+         real, explicit permission set is untouched. -->
+    <changeSet id="0547-1" author="cbs-nitesh">
+        <sql>
+            DELETE FROM m_role_permission
+             WHERE role_id = (SELECT id FROM m_role WHERE name = 'Clerk')
+               AND permission_id = (SELECT id FROM m_permission WHERE code = 'ALL_FUNCTIONS')
+        </sql>
+    </changeSet>
+</databaseChangeLog>