diff --git a/src/lib/repositories/CatchRecordRepository.ts b/src/lib/repositories/CatchRecordRepository.ts
index 4767265..f9d25e0 100644
--- a/src/lib/repositories/CatchRecordRepository.ts
+++ b/src/lib/repositories/CatchRecordRepository.ts
@@ -93,7 +93,7 @@ class CatchRecordRepository {
 		const { data: result, error } = await this.supabase
 			.from('catch_records')
 			.upsert(dbRows, {
-				onConflict: 'userId,pokedexId,pokedexEntryId'
+				onConflict: '"userId","pokedexId","pokedexEntryId"'
 			})
 			.select();
 
diff --git a/supabase/migrations/20260110114000_fix_catch_records_unique_constraint.sql b/supabase/migrations/20260110114000_fix_catch_records_unique_constraint.sql
index ec699e8..0da0a1f 100644
--- a/supabase/migrations/20260110114000_fix_catch_records_unique_constraint.sql
+++ b/supabase/migrations/20260110114000_fix_catch_records_unique_constraint.sql
@@ -196,6 +196,14 @@ CREATE POLICY "Users can update own catch records" ON public.catch_records
 			WHERE public.pokedexes.id = public.catch_records."pokedexId"
 				AND public.pokedexes."userId" = auth.uid()
 		)
+	)
+	WITH CHECK (
+		auth.uid() = new."userId" AND
+		EXISTS (
+			SELECT 1 FROM public.pokedexes
+			WHERE public.pokedexes.id = new."pokedexId"
+				AND public.pokedexes."userId" = auth.uid()
+		)
 	);
 
 CREATE POLICY "Users can delete own catch records" ON public.catch_records