diff --git a/stacks/projects/kj-pola-backend-stg/cloud-run.tf b/stacks/projects/kj-pola-backend-stg/cloud-run.tf
index 8ad0a19..7ab9a91 100644
--- a/stacks/projects/kj-pola-backend-stg/cloud-run.tf
+++ b/stacks/projects/kj-pola-backend-stg/cloud-run.tf
@@ -1,3 +1,11 @@
+data "google_project" "current" {
+  project_id = var.project_id
+}
+
+locals {
+  cloud_run_service_account_name  = "${var.name.app}-${var.name.component}-${var.name.env}"
+}
+
 module "cloud_run" {
   source = "github.com/GoogleCloudPlatform/cloud-foundation-fabric//modules/cloud-run-v2?ref=v51.0.0"
 
@@ -27,14 +35,17 @@ module "cloud_run" {
   }
 
   service_account_config = {
+    name  = local.cloud_run_service_account_name
     roles = var.cloud_run_service_account_roles
   }
 
   # Terraform does the initial deployment only; CI/CD manages revisions after.
   managed_revision = false
+  deletion_protection = false
 
   service_config = {
     ingress = "INGRESS_TRAFFIC_ALL"
+    invoker_iam_disabled = true
     scaling = {
       min_instance_count = var.cloud_run_min_instances
       max_instance_count = var.cloud_run_max_instances
@@ -49,12 +60,12 @@ module "cloud_run" {
 
 # Grant Cloud Run service account permission to read from Artifact Registry in shared project
 # This is needed because the Docker image is in kj-pola-shared-prod project
-resource "google_project_iam_member" "cloud_run_sa_artifact_registry_reader" {
+resource "google_project_iam_member" "cloud_run_service_agent_artifact_registry_reader" {
   project = "kj-pola-shared-prod"
   role    = "roles/artifactregistry.reader"
-  member  = "serviceAccount:${module.cloud_run.service_account_email}"
+  member  = "serviceAccount:service-${data.google_project.current.number}@serverless-robot-prod.iam.gserviceaccount.com"
 
   depends_on = [
-    module.cloud_run
+    module.project_services
   ]
 }
diff --git a/stacks/projects/kj-pola-backend-stg/cloudsql.tf b/stacks/projects/kj-pola-backend-stg/cloudsql.tf
index c5dfbf1..bd9fe4d 100644
--- a/stacks/projects/kj-pola-backend-stg/cloudsql.tf
+++ b/stacks/projects/kj-pola-backend-stg/cloudsql.tf
@@ -21,6 +21,10 @@ module "cloudsql" {
       name  = "autovacuum"
       value = "on"
     },
+    {
+      name  = "cloudsql.iam_authentication"
+      value = "on"
+    },
     {
       name  = "timezone"
       value = "Europe/Warsaw"
@@ -55,6 +59,22 @@ module "cloudsql" {
   maintenance_window_hour         = var.cloudsql_maintenance_window_hour
   maintenance_window_update_track = var.cloudsql_maintenance_window_update_track
 
+  additional_databases = [
+    {
+      name      = "pola"
+      charset   = "UTF8"
+      collation = "en_US.UTF8"
+    }
+  ]
+
+  iam_users = [
+    {
+      id    = "pola"
+      email = "${var.name.app}-${var.name.component}-${var.name.env}@${var.project_id}.iam.gserviceaccount.com"
+      type  = "CLOUD_IAM_SERVICE_ACCOUNT"
+    }
+  ]
+
   depends_on = [
     module.vpc
   ]
diff --git a/stacks/projects/kj-pola-backend-stg/terraform.tfvars b/stacks/projects/kj-pola-backend-stg/terraform.tfvars
index 9853f58..7e7ba60 100644
--- a/stacks/projects/kj-pola-backend-stg/terraform.tfvars
+++ b/stacks/projects/kj-pola-backend-stg/terraform.tfvars
@@ -52,7 +52,7 @@ private_service_access_cidr = "10.1.0.0/24"
 # Cloud SQL Configuration
 cloudsql_database_version                = "POSTGRES_15"
 cloudsql_tier                            = "db-f1-micro"
-cloudsql_deletion_protection             = false
+cloudsql_deletion_protection             = true
 cloudsql_disk_type                       = "PD_SSD"
 cloudsql_disk_size                       = 10
 cloudsql_disk_autoresize                 = true
@@ -75,6 +75,6 @@ cloud_run_service_account_roles = [
   "roles/artifactregistry.reader",
 ]
 cloud_run_min_instances = 0
-cloud_run_max_instances = 1
+cloud_run_max_instances = 2
 cloud_run_cpu_limit     = "1000m"
 cloud_run_memory_limit  = "512Mi"