diff --git a/internal/db/migrations/postgres.gen.go b/internal/db/migrations/postgres.gen.go
index 608cea8f4..813a4c80e 100644
--- a/internal/db/migrations/postgres.gen.go
+++ b/internal/db/migrations/postgres.gen.go
@@ -39,6 +39,7 @@ comment on domain wt_public_id is
 'Random ID generated with github.com/hashicorp/vault/sdk/helper/base62';
 
 create domain wt_private_id as text
+not null
 check(
   length(trim(value)) > 10
 );
@@ -53,6 +54,7 @@ comment on domain wt_scope_id is
 '"global" or random ID generated with github.com/hashicorp/vault/sdk/helper/base62';
 
 create domain wt_user_id as text
+not null
 check(
   length(trim(value)) > 10 or value = 'u_anon' or value = 'u_auth'
 );
@@ -60,6 +62,7 @@ comment on domain wt_scope_id is
 '"u_anon", "u_auth", or random ID generated with github.com/hashicorp/vault/sdk/helper/base62';
 
 create domain wt_role_id as text
+not null
 check(
   length(trim(value)) > 10 or value = 'r_default'
 );
@@ -576,7 +579,8 @@ create table iam_scope_org (
     references iam_scope(public_id)
     on delete cascade
     on update cascade,
-  parent_id wt_scope_id not null
+  parent_id wt_scope_id
+    not null
     references iam_scope_global(scope_id)
     on delete cascade
     on update cascade,
@@ -585,7 +589,11 @@ create table iam_scope_org (
 );
 
 create table iam_scope_project (
-    scope_id wt_scope_id not null references iam_scope(public_id) on delete cascade on update cascade,
+    scope_id wt_scope_id
+      not null
+      references iam_scope(public_id)
+      on delete cascade
+      on update cascade,
     parent_id wt_public_id not null references iam_scope_org(scope_id) on delete cascade on update cascade,
     name text,
     unique(parent_id, name),
@@ -728,12 +736,17 @@ insert into iam_scope (public_id, name, type, description)
 
 
 create table iam_user (
-    public_id wt_user_id primary key,
+    public_id wt_user_id
+      primary key,
     create_time wt_timestamp,
     update_time wt_timestamp,
     name text,
     description text,
-    scope_id wt_scope_id not null references iam_scope(public_id) on delete cascade on update cascade,
+    scope_id wt_scope_id
+      not null
+      references iam_scope(public_id)
+      on delete cascade
+      on update cascade,
     unique(name, scope_id),
     version wt_version,
 
@@ -849,7 +862,7 @@ insert into iam_user (public_id, name, description, scope_id)
   values ('u_auth', 'authenticated', 'The authenticated user matches any user that has a valid token', 'global');
 
  -- define the immutable fields for iam_user
-create trigger 
+create trigger
   immutable_columns
 before
 update on iam_user
@@ -861,8 +874,16 @@ create table iam_role (
     update_time wt_timestamp,
     name text,
     description text,
-    scope_id wt_scope_id not null references iam_scope(public_id) on delete cascade on update cascade,
-    grant_scope_id wt_scope_id not null references iam_scope(public_id) on delete cascade on update cascade,
+    scope_id wt_scope_id
+      not null
+      references iam_scope(public_id)
+      on delete cascade
+      on update cascade,
+    grant_scope_id wt_scope_id
+      not null
+      references iam_scope(public_id)
+      on delete cascade
+      on update cascade,
     unique(name, scope_id),
     version wt_version,
 
@@ -940,12 +961,17 @@ update on iam_role
   for each row execute procedure immutable_columns('public_id', 'create_time', 'scope_id');
 
 create table iam_group (
-    public_id wt_public_id not null primary key,
+    public_id wt_public_id
+      primary key,
     create_time wt_timestamp,
     update_time wt_timestamp,
     name text,
     description text,
-    scope_id wt_scope_id not null references iam_scope(public_id) on delete cascade on update cascade,
+    scope_id wt_scope_id
+      not null
+      references iam_scope(public_id)
+      on delete cascade
+      on update cascade,
     unique(name, scope_id),
     -- version allows optimistic locking of the group when modifying the group
     -- itself and when modifying dependent items like group members. 
@@ -1237,8 +1263,10 @@ begin;
 
   -- base table for auth methods
   create table auth_method (
-    public_id wt_public_id primary key,
-    scope_id wt_scope_id not null
+    public_id wt_public_id
+      primary key,
+    scope_id wt_scope_id
+      not null
       references iam_scope(public_id)
       on delete cascade
       on update cascade,
@@ -1252,9 +1280,12 @@ begin;
 
   -- base table for auth accounts
   create table auth_account (
-    public_id wt_public_id primary key,
-    auth_method_id wt_public_id not null,
-    scope_id wt_scope_id not null,
+    public_id wt_public_id
+      primary key,
+    auth_method_id wt_public_id
+      not null,
+    scope_id wt_scope_id
+      not null,
     iam_user_id wt_public_id,
     -- including scope_id in fk1 and fk2 ensures the scope_id of the owning
     -- auth_method and the scope_id of the owning iam_user are the same
@@ -1590,15 +1621,21 @@ begin;
 */
 
   create table auth_password_method (
-    public_id wt_public_id primary key,
-    scope_id wt_scope_id not null,
-    password_conf_id wt_private_id not null, -- FK to auth_password_conf added below
+    public_id wt_public_id
+      primary key,
+    scope_id wt_scope_id
+      not null,
+    password_conf_id wt_private_id, -- FK to auth_password_conf added below
     name text,
     description text,
     create_time wt_timestamp,
     update_time wt_timestamp,
-    min_login_name_length int not null default 3,
-    min_password_length int not null default 8,
+    min_login_name_length int
+      not null
+      default 3,
+    min_password_length int
+      not null
+      default 8,
     version wt_version,
     foreign key (scope_id, public_id)
       references auth_method (scope_id, public_id)
@@ -1619,8 +1656,10 @@ begin;
     for each row execute procedure insert_auth_method_subtype();
 
   create table auth_password_account (
-    public_id wt_public_id primary key,
-    auth_method_id wt_public_id not null,
+    public_id wt_public_id
+      primary key,
+    auth_method_id wt_public_id
+      not null,
     -- NOTE(mgaffney): The scope_id type is not wt_scope_id because the domain
     -- check is executed before the insert trigger which retrieves the scope_id
     -- causing an insert to fail.
@@ -1660,8 +1699,10 @@ begin;
     for each row execute procedure insert_auth_account_subtype();
 
   create table auth_password_conf (
-    private_id wt_private_id primary key,
-    password_method_id wt_public_id not null
+    private_id wt_private_id
+      primary key,
+    password_method_id wt_public_id
+      not null
       references auth_password_method (public_id)
       on delete cascade
       on update cascade
@@ -1693,10 +1734,14 @@ begin;
   $$ language plpgsql;
 
   create table auth_password_credential (
-    private_id wt_private_id primary key,
-    password_account_id wt_public_id not null unique,
-    password_conf_id wt_private_id not null,
-    password_method_id wt_public_id not null,
+    private_id wt_private_id
+      primary key,
+    password_account_id wt_public_id
+      not null
+      unique,
+    password_conf_id wt_private_id,
+    password_method_id wt_public_id
+      not null,
     foreign key (password_method_id, password_conf_id)
       references auth_password_conf (password_method_id, private_id)
       on delete cascade
@@ -1889,7 +1934,7 @@ begin;
       on delete cascade
       on update cascade,
     password_account_id wt_public_id not null,
-    password_conf_id wt_private_id not null,
+    password_conf_id wt_private_id,
     -- NOTE(mgaffney): The password_method_id type is not wt_public_id because
     -- the domain check is executed before the insert trigger which retrieves
     -- the password_method_id causing an insert to fail.
@@ -2086,8 +2131,10 @@ begin;
 
   -- host_catalog
   create table host_catalog (
-    public_id wt_public_id primary key,
-    scope_id wt_scope_id not null
+    public_id wt_public_id
+      primary key,
+    scope_id wt_scope_id
+      not null
       references iam_scope (public_id)
       on delete cascade
       on update cascade,
@@ -2280,8 +2327,10 @@ begin;
 */
 
   create table static_host_catalog (
-    public_id wt_public_id primary key,
-    scope_id wt_scope_id not null
+    public_id wt_public_id
+      primary key,
+    scope_id wt_scope_id
+      not null
       references iam_scope (public_id)
       on delete cascade
       on update cascade,
diff --git a/internal/db/migrations/postgres/01_domain_types.up.sql b/internal/db/migrations/postgres/01_domain_types.up.sql
index b96b44f5d..272274d04 100644
--- a/internal/db/migrations/postgres/01_domain_types.up.sql
+++ b/internal/db/migrations/postgres/01_domain_types.up.sql
@@ -8,6 +8,7 @@ comment on domain wt_public_id is
 'Random ID generated with github.com/hashicorp/vault/sdk/helper/base62';
 
 create domain wt_private_id as text
+not null
 check(
   length(trim(value)) > 10
 );
@@ -22,6 +23,7 @@ comment on domain wt_scope_id is
 '"global" or random ID generated with github.com/hashicorp/vault/sdk/helper/base62';
 
 create domain wt_user_id as text
+not null
 check(
   length(trim(value)) > 10 or value = 'u_anon' or value = 'u_auth'
 );
@@ -29,6 +31,7 @@ comment on domain wt_scope_id is
 '"u_anon", "u_auth", or random ID generated with github.com/hashicorp/vault/sdk/helper/base62';
 
 create domain wt_role_id as text
+not null
 check(
   length(trim(value)) > 10 or value = 'r_default'
 );
diff --git a/internal/db/migrations/postgres/06_iam.up.sql b/internal/db/migrations/postgres/06_iam.up.sql
index db94a95dd..73ab3c0e5 100644
--- a/internal/db/migrations/postgres/06_iam.up.sql
+++ b/internal/db/migrations/postgres/06_iam.up.sql
@@ -62,7 +62,8 @@ create table iam_scope_org (
     references iam_scope(public_id)
     on delete cascade
     on update cascade,
-  parent_id wt_scope_id not null
+  parent_id wt_scope_id
+    not null
     references iam_scope_global(scope_id)
     on delete cascade
     on update cascade,
@@ -71,7 +72,11 @@ create table iam_scope_org (
 );
 
 create table iam_scope_project (
-    scope_id wt_scope_id not null references iam_scope(public_id) on delete cascade on update cascade,
+    scope_id wt_scope_id
+      not null
+      references iam_scope(public_id)
+      on delete cascade
+      on update cascade,
     parent_id wt_public_id not null references iam_scope_org(scope_id) on delete cascade on update cascade,
     name text,
     unique(parent_id, name),
@@ -214,12 +219,17 @@ insert into iam_scope (public_id, name, type, description)
 
 
 create table iam_user (
-    public_id wt_user_id primary key,
+    public_id wt_user_id
+      primary key,
     create_time wt_timestamp,
     update_time wt_timestamp,
     name text,
     description text,
-    scope_id wt_scope_id not null references iam_scope(public_id) on delete cascade on update cascade,
+    scope_id wt_scope_id
+      not null
+      references iam_scope(public_id)
+      on delete cascade
+      on update cascade,
     unique(name, scope_id),
     version wt_version,
 
@@ -335,7 +345,7 @@ insert into iam_user (public_id, name, description, scope_id)
   values ('u_auth', 'authenticated', 'The authenticated user matches any user that has a valid token', 'global');
 
  -- define the immutable fields for iam_user
-create trigger 
+create trigger
   immutable_columns
 before
 update on iam_user
@@ -347,8 +357,16 @@ create table iam_role (
     update_time wt_timestamp,
     name text,
     description text,
-    scope_id wt_scope_id not null references iam_scope(public_id) on delete cascade on update cascade,
-    grant_scope_id wt_scope_id not null references iam_scope(public_id) on delete cascade on update cascade,
+    scope_id wt_scope_id
+      not null
+      references iam_scope(public_id)
+      on delete cascade
+      on update cascade,
+    grant_scope_id wt_scope_id
+      not null
+      references iam_scope(public_id)
+      on delete cascade
+      on update cascade,
     unique(name, scope_id),
     version wt_version,
 
@@ -426,12 +444,17 @@ update on iam_role
   for each row execute procedure immutable_columns('public_id', 'create_time', 'scope_id');
 
 create table iam_group (
-    public_id wt_public_id not null primary key,
+    public_id wt_public_id
+      primary key,
     create_time wt_timestamp,
     update_time wt_timestamp,
     name text,
     description text,
-    scope_id wt_scope_id not null references iam_scope(public_id) on delete cascade on update cascade,
+    scope_id wt_scope_id
+      not null
+      references iam_scope(public_id)
+      on delete cascade
+      on update cascade,
     unique(name, scope_id),
     -- version allows optimistic locking of the group when modifying the group
     -- itself and when modifying dependent items like group members. 
diff --git a/internal/db/migrations/postgres/07_auth.up.sql b/internal/db/migrations/postgres/07_auth.up.sql
index 1f190436e..8c45f3eb5 100644
--- a/internal/db/migrations/postgres/07_auth.up.sql
+++ b/internal/db/migrations/postgres/07_auth.up.sql
@@ -48,8 +48,10 @@ begin;
 
   -- base table for auth methods
   create table auth_method (
-    public_id wt_public_id primary key,
-    scope_id wt_scope_id not null
+    public_id wt_public_id
+      primary key,
+    scope_id wt_scope_id
+      not null
       references iam_scope(public_id)
       on delete cascade
       on update cascade,
@@ -63,9 +65,12 @@ begin;
 
   -- base table for auth accounts
   create table auth_account (
-    public_id wt_public_id primary key,
-    auth_method_id wt_public_id not null,
-    scope_id wt_scope_id not null,
+    public_id wt_public_id
+      primary key,
+    auth_method_id wt_public_id
+      not null,
+    scope_id wt_scope_id
+      not null,
     iam_user_id wt_public_id,
     -- including scope_id in fk1 and fk2 ensures the scope_id of the owning
     -- auth_method and the scope_id of the owning iam_user are the same
diff --git a/internal/db/migrations/postgres/12_auth_password.up.sql b/internal/db/migrations/postgres/12_auth_password.up.sql
index cab31fc74..772ddf103 100644
--- a/internal/db/migrations/postgres/12_auth_password.up.sql
+++ b/internal/db/migrations/postgres/12_auth_password.up.sql
@@ -57,15 +57,21 @@ begin;
 */
 
   create table auth_password_method (
-    public_id wt_public_id primary key,
-    scope_id wt_scope_id not null,
-    password_conf_id wt_private_id not null, -- FK to auth_password_conf added below
+    public_id wt_public_id
+      primary key,
+    scope_id wt_scope_id
+      not null,
+    password_conf_id wt_private_id, -- FK to auth_password_conf added below
     name text,
     description text,
     create_time wt_timestamp,
     update_time wt_timestamp,
-    min_login_name_length int not null default 3,
-    min_password_length int not null default 8,
+    min_login_name_length int
+      not null
+      default 3,
+    min_password_length int
+      not null
+      default 8,
     version wt_version,
     foreign key (scope_id, public_id)
       references auth_method (scope_id, public_id)
@@ -86,8 +92,10 @@ begin;
     for each row execute procedure insert_auth_method_subtype();
 
   create table auth_password_account (
-    public_id wt_public_id primary key,
-    auth_method_id wt_public_id not null,
+    public_id wt_public_id
+      primary key,
+    auth_method_id wt_public_id
+      not null,
     -- NOTE(mgaffney): The scope_id type is not wt_scope_id because the domain
     -- check is executed before the insert trigger which retrieves the scope_id
     -- causing an insert to fail.
@@ -127,8 +135,10 @@ begin;
     for each row execute procedure insert_auth_account_subtype();
 
   create table auth_password_conf (
-    private_id wt_private_id primary key,
-    password_method_id wt_public_id not null
+    private_id wt_private_id
+      primary key,
+    password_method_id wt_public_id
+      not null
       references auth_password_method (public_id)
       on delete cascade
       on update cascade
@@ -160,10 +170,14 @@ begin;
   $$ language plpgsql;
 
   create table auth_password_credential (
-    private_id wt_private_id primary key,
-    password_account_id wt_public_id not null unique,
-    password_conf_id wt_private_id not null,
-    password_method_id wt_public_id not null,
+    private_id wt_private_id
+      primary key,
+    password_account_id wt_public_id
+      not null
+      unique,
+    password_conf_id wt_private_id,
+    password_method_id wt_public_id
+      not null,
     foreign key (password_method_id, password_conf_id)
       references auth_password_conf (password_method_id, private_id)
       on delete cascade
diff --git a/internal/db/migrations/postgres/13_auth_password_argon.up.sql b/internal/db/migrations/postgres/13_auth_password_argon.up.sql
index 78fb9244c..bae2c209d 100644
--- a/internal/db/migrations/postgres/13_auth_password_argon.up.sql
+++ b/internal/db/migrations/postgres/13_auth_password_argon.up.sql
@@ -56,7 +56,7 @@ begin;
       on delete cascade
       on update cascade,
     password_account_id wt_public_id not null,
-    password_conf_id wt_private_id not null,
+    password_conf_id wt_private_id,
     -- NOTE(mgaffney): The password_method_id type is not wt_public_id because
     -- the domain check is executed before the insert trigger which retrieves
     -- the password_method_id causing an insert to fail.
diff --git a/internal/db/migrations/postgres/20_host.up.sql b/internal/db/migrations/postgres/20_host.up.sql
index b5c4a52d4..80f1ded11 100644
--- a/internal/db/migrations/postgres/20_host.up.sql
+++ b/internal/db/migrations/postgres/20_host.up.sql
@@ -38,8 +38,10 @@ begin;
 
   -- host_catalog
   create table host_catalog (
-    public_id wt_public_id primary key,
-    scope_id wt_scope_id not null
+    public_id wt_public_id
+      primary key,
+    scope_id wt_scope_id
+      not null
       references iam_scope (public_id)
       on delete cascade
       on update cascade,
diff --git a/internal/db/migrations/postgres/22_static_host.up.sql b/internal/db/migrations/postgres/22_static_host.up.sql
index e957b004f..d240ffb6f 100644
--- a/internal/db/migrations/postgres/22_static_host.up.sql
+++ b/internal/db/migrations/postgres/22_static_host.up.sql
@@ -37,8 +37,10 @@ begin;
 */
 
   create table static_host_catalog (
-    public_id wt_public_id primary key,
-    scope_id wt_scope_id not null
+    public_id wt_public_id
+      primary key,
+    scope_id wt_scope_id
+      not null
       references iam_scope (public_id)
       on delete cascade
       on update cascade,