diff --git a/internal/db/migrations/postgres.gen.go b/internal/db/migrations/postgres.gen.go
index fccac5a56..01210fc48 100644
--- a/internal/db/migrations/postgres.gen.go
+++ b/internal/db/migrations/postgres.gen.go
@@ -2703,7 +2703,7 @@ before insert on kms_root_key_version
 
 create table kms_database_key (
   private_id wt_private_id primary key,
-  root_key_id wt_private_id not null
+  root_key_id wt_private_id not null unique -- there can be only one database dek per root key
     references kms_root_key(private_id)
     on delete cascade
     on update cascade,
@@ -2759,7 +2759,7 @@ before insert on kms_database_key_version
 
 create table kms_oplog_key (
   private_id wt_private_id primary key,
-  root_key_id wt_private_id not null
+  root_key_id wt_private_id not null unique -- there can be only one oplog dek per root key
     references kms_root_key(private_id)
     on delete cascade
     on update cascade,
@@ -2815,7 +2815,7 @@ before insert on kms_oplog_key_version
 
 create table kms_session_key (
   private_id wt_private_id primary key,
-  root_key_id wt_private_id not null
+  root_key_id wt_private_id not null unique -- there can be only one session dek per root key
     references kms_root_key(private_id)
     on delete cascade
     on update cascade,
diff --git a/internal/proto/local/controller/api/resources/roles/v1/role.proto b/internal/proto/local/controller/api/resources/roles/v1/role.proto
index 2c46813be..cebe71cb4 100644
--- a/internal/proto/local/controller/api/resources/roles/v1/role.proto
+++ b/internal/proto/local/controller/api/resources/roles/v1/role.proto
@@ -96,7 +96,7 @@ message Role {
 
 	// The grants that this role provides for its principals.
 	// Output only.
-	repeated string grant_strings = 110[json_name="grant_strings"];
+	repeated string grant_strings = 110 [json_name="grant_strings"];
 
 	// The parsed grant information.
 	// Output only.