diff --git a/prisma/schema.prisma b/prisma/schema.prisma
index 6c4b927..07201d1 100644
--- a/prisma/schema.prisma
+++ b/prisma/schema.prisma
@@ -280,10 +280,10 @@ model MenuScan {
 model MenuItem {
   id             String    @id @default(cuid())
   // Denormalised from MenuScan. Ownership was only ever transitive via scanId, which
-  // worked because nothing queries MenuItem directly - but left any future direct
-  // query an IDOR with nothing to stop it. Nullable only for rows created before
-  // this column existed; every write sets it.
-  userId         String?
+  // held because nothing queries MenuItem directly - but left any future direct query
+  // an IDOR with nothing to stop it. Backfilled from the parent scan, then made
+  // required so it cannot silently go missing.
+  userId         String
   scanId         String
   name           String
   type           DrinkType