diff --git a/backend/alembic/versions/0012_config_add_download_token.py b/backend/alembic/versions/0012_config_add_download_token.py
new file mode 100644
index 0000000..fccb647
--- /dev/null
+++ b/backend/alembic/versions/0012_config_add_download_token.py
@@ -0,0 +1,35 @@
+"""add download_token to configs
+
+Revision ID: 0012
+Revises: 0011
+Create Date: 2026-03-01
+"""
+import secrets
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.sql import table, column
+
+revision = "0012"
+down_revision = "0011"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        "configs",
+        sa.Column("download_token", sa.String(64), nullable=False, server_default=""),
+    )
+    # Backfill existing rows with unique tokens
+    configs = table("configs", column("id", sa.Integer), column("download_token", sa.String(64)))
+    conn = op.get_bind()
+    for row in conn.execute(sa.select(configs.c.id)):
+        conn.execute(
+            configs.update()
+            .where(configs.c.id == row.id)
+            .values(download_token=secrets.token_urlsafe(32))
+        )
+
+
+def downgrade() -> None:
+    op.drop_column("configs", "download_token")