diff --git a/pos/migrations/v4.11_clean_workshop_mechanic_permissions.sql b/pos/migrations/v4.11_clean_workshop_mechanic_permissions.sql
new file mode 100644
index 0000000..0fb580f
--- /dev/null
+++ b/pos/migrations/v4.11_clean_workshop_mechanic_permissions.sql
@@ -0,0 +1,24 @@
+-- v4.11_clean_workshop_mechanic_permissions.sql
+-- Restringe los permisos de los empleados con rol 'workshop' y 'mechanic'
+-- para que solo tengan acceso a la seccion de Taller y no vean precios.
+-- Ejecutar en cada base de datos de tenant.
+
+-- 1. Eliminar cualquier permiso que no sea de taller para estos roles
+DELETE FROM employee_permissions
+WHERE employee_id IN (
+    SELECT id FROM employees WHERE role IN ('workshop', 'mechanic')
+)
+AND permission NOT IN ('workshop.view', 'workshop.edit', 'workshop.add_items');
+
+-- 2. Asegurar que tengan los permisos base de taller
+INSERT INTO employee_permissions (employee_id, permission)
+SELECT e.id, p.permission
+FROM employees e
+CROSS JOIN (
+    VALUES
+        ('workshop.view'),
+        ('workshop.edit'),
+        ('workshop.add_items')
+) AS p(permission)
+WHERE e.role IN ('workshop', 'mechanic')
+ON CONFLICT (employee_id, permission) DO NOTHING;