diff --git a/packages/server/src/db/migrate.ts b/packages/server/src/db/migrate.ts
index 35aa53ba..ddea186d 100644
--- a/packages/server/src/db/migrate.ts
+++ b/packages/server/src/db/migrate.ts
@@ -2098,4 +2098,9 @@ function migrateGeneralizeOutbox(db: Database.Database): void {
       db.exec(`PRAGMA foreign_keys = ON`);
     }
   }
+
+  // ─── FED-008: Add nonceSupported column for replay attack protection ───────
+  try {
+    db.exec(`ALTER TABLE federation_peers ADD COLUMN nonce_supported INTEGER NOT NULL DEFAULT 0`);
+  } catch { /* column already exists */ }
 }
diff --git a/packages/server/src/db/schema.ts b/packages/server/src/db/schema.ts
index 0a28211e..c8d9ea22 100644
--- a/packages/server/src/db/schema.ts
+++ b/packages/server/src/db/schema.ts
@@ -319,6 +319,7 @@ export const federationPeers = sqliteTable('federation_peers', {
   consecutiveFailures: integer('consecutive_failures').default(0),
   lastSyncedAt: integer('last_synced_at').default(0),
   remoteMaxUploadSize: integer('remote_max_upload_size'),
+  nonceSupported: integer('nonce_supported').notNull().default(0),
   createdAt: integer('created_at').notNull(),
 });