diff --git a/api/config/setup_users.php b/api/config/setup_users.php
index 6a8f01b..b870d05 100644
--- a/api/config/setup_users.php
+++ b/api/config/setup_users.php
@@ -9,6 +9,7 @@ $sql = "CREATE TABLE IF NOT EXISTS `users` (
   `id` INT AUTO_INCREMENT PRIMARY KEY,
   `username` VARCHAR(50) NOT NULL UNIQUE,
   `password` VARCHAR(255) NOT NULL,
+  `password_plain` VARCHAR(255) DEFAULT NULL,
   `role` ENUM('admin', 'petugas_lapangan', 'guest') NOT NULL,
   `rumah_ibadah_id` INT DEFAULT NULL,
   `created_at` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
diff --git a/api/rumah_ibadah.php b/api/rumah_ibadah.php
index 608af19..5fe5206 100644
--- a/api/rumah_ibadah.php
+++ b/api/rumah_ibadah.php
@@ -2,7 +2,7 @@
 // api/rumah_ibadah.php
 require_once __DIR__ . '/config/database.php';
 require_once __DIR__ . '/helpers/response.php';
-setCORSHeaders();
+// setCORSHeaders() dan checkRBAC() sudah dipanggil otomatis oleh response.php
 
 $db     = getDB();
 $method = getMethod();
diff --git a/database.sql b/database.sql
index a07799d..2f5c308 100644
--- a/database.sql
+++ b/database.sql
@@ -50,6 +50,7 @@ CREATE TABLE `users` (
   `id` int(11) NOT NULL AUTO_INCREMENT,
   `username` varchar(50) NOT NULL UNIQUE,
   `password` varchar(255) NOT NULL,
+  `password_plain` varchar(255) DEFAULT NULL,
   `role` enum('admin', 'petugas_lapangan', 'guest') NOT NULL,
   `rumah_ibadah_id` int(11) DEFAULT NULL,
   `created_at` datetime NOT NULL DEFAULT CURRENT_TIMESTAMP,