diff --git a/ops/environments/production/teleport-access.patch.yaml b/ops/environments/production/teleport-access.patch.yaml
index 9e7f4ac..d935c8c 100644
--- a/ops/environments/production/teleport-access.patch.yaml
+++ b/ops/environments/production/teleport-access.patch.yaml
@@ -19,6 +19,21 @@
       inherit: true
       connectionLimit: 5
       disablePassword: true
+    - name: teleport_rw
+      comment: Teleport certificate login, data read-write
+      inRoles:
+        - pg_read_all_data
+        - pg_write_all_data
+      ensure: present
+      login: true
+      superuser: false
+      createdb: false
+      createrole: false
+      replication: false
+      bypassrls: false
+      inherit: true
+      connectionLimit: 5
+      disablePassword: true
 - op: add
   path: /spec/postgresql/pg_hba/0
-  value: hostssl all teleport 10.42.0.0/16 cert
+  value: hostssl all teleport,teleport_rw 10.42.0.0/16 cert