diff --git a/services/cassandra-auth/bootstrap-jobs/cassandra-realm-ensure-job.yaml b/services/cassandra-auth/bootstrap-jobs/cassandra-realm-ensure-job.yaml
index be123545a..ea8a1126d 100644
--- a/services/cassandra-auth/bootstrap-jobs/cassandra-realm-ensure-job.yaml
+++ b/services/cassandra-auth/bootstrap-jobs/cassandra-realm-ensure-job.yaml
@@ -1,11 +1,11 @@
 # services/keycloak/bootstrap-jobs/cassandra-realm-ensure-job.yaml
-# One-off job for sso/cassandra-realm-ensure-1.
+# One-off job for sso/cassandra-realm-ensure-3.
 # Purpose: create the Cassandra realm, groups, OIDC client, SMTP settings, and Vault client secret.
 # Keep suspended until Cassandra Vault paths/policies have reconciled, then unsuspend once.
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: cassandra-realm-ensure-2
+  name: cassandra-realm-ensure-3
   namespace: sso
 spec:
   suspend: false
@@ -70,7 +70,7 @@ spec:
             - name: KEYCLOAK_SMTP_FROM_NAME
               value: Cassandra
             - name: CASSANDRA_PUBLIC_REPLAY_USERS
-              value: veles-dev,cassandra-dev,daniel-test,viktor-test
+              value: veles-dev,daniel-test,viktor-test
           command: ["/bin/sh", "-c"]
           args:
             - |
@@ -260,15 +260,35 @@ spec:
                   if status not in (200, 204):
                       raise SystemExit(f"User group update failed for {username}: status={status} body={body}")
 
-              ensure_group("alpha")
+              alpha_group = ensure_group("alpha")
               ensure_group("admin")
-              ensure_group(os.environ["CASSANDRA_TESTER_GROUP"])
+              tester_group = ensure_group(os.environ["CASSANDRA_TESTER_GROUP"])
               public_replay_group = ensure_group("public-replay")
+              pilot_groups = {
+                  "pilot-skill-proficient": ensure_group("pilot-skill-proficient"),
+                  "pilot-skill-adept": ensure_group("pilot-skill-adept"),
+                  "pilot-skill-veteran": ensure_group("pilot-skill-veteran"),
+                  "pilot-skill-expert": ensure_group("pilot-skill-expert"),
+                  "pilot-skill-master": ensure_group("pilot-skill-master"),
+                  "all-pilot-skill-level": ensure_group("all-pilot-skill-level"),
+                  "codex-cli-fallback": ensure_group("codex-cli-fallback"),
+              }
               for username in os.environ.get("CASSANDRA_PUBLIC_REPLAY_USERS", "").split(","):
                   username = username.strip()
                   if username:
                       ensure_user_group(username, public_replay_group)
 
+              ensure_user_group("veles-dev", tester_group)
+              ensure_user_group("veles-dev", pilot_groups["all-pilot-skill-level"])
+              ensure_user_group("veles-dev", pilot_groups["codex-cli-fallback"])
+              for username in ("daniel-test", "viktor-test"):
+                  ensure_user_group(username, alpha_group)
+                  ensure_user_group(username, tester_group)
+                  ensure_user_group(username, pilot_groups["pilot-skill-proficient"])
+                  ensure_user_group(username, pilot_groups["pilot-skill-adept"])
+                  ensure_user_group(username, pilot_groups["pilot-skill-veteran"])
+                  ensure_user_group(username, pilot_groups["codex-cli-fallback"])
+
               status, clients = request(
                   "GET",
                   f"{base_url}/admin/realms/{realm}/clients?clientId={urllib.parse.quote(client_id)}",