diff --git a/.sqlx/query-10d71ae9e9d2c39546ab0075809d0c17742dd5b6377f40704dfec1c76f51f839.json b/.sqlx/query-10d71ae9e9d2c39546ab0075809d0c17742dd5b6377f40704dfec1c76f51f839.json
new file mode 100644
index 0000000..8cf469b
--- /dev/null
+++ b/.sqlx/query-10d71ae9e9d2c39546ab0075809d0c17742dd5b6377f40704dfec1c76f51f839.json
@@ -0,0 +1,58 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "select\n                id,\n                workspace_id,\n                name,\n                kind,\n                config_json,\n                to_char(created_at at time zone 'UTC', 'YYYY-MM-DD\"T\"HH24:MI:SS\"Z\"') as \"created_at!\",\n                to_char(updated_at at time zone 'UTC', 'YYYY-MM-DD\"T\"HH24:MI:SS\"Z\"') as \"updated_at!\"\n             from auth_profiles\n             where workspace_id = $1\n             order by name asc",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 1,
+        "name": "workspace_id",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 2,
+        "name": "name",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 3,
+        "name": "kind",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 4,
+        "name": "config_json",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 5,
+        "name": "created_at!",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 6,
+        "name": "updated_at!",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      false,
+      false,
+      null,
+      null
+    ]
+  },
+  "hash": "10d71ae9e9d2c39546ab0075809d0c17742dd5b6377f40704dfec1c76f51f839"
+}
diff --git a/.sqlx/query-f51d113d5f026b0b11e086cc5a37578dcc6977ce6eb90a8fc3afe63023598c06.json b/.sqlx/query-f51d113d5f026b0b11e086cc5a37578dcc6977ce6eb90a8fc3afe63023598c06.json
new file mode 100644
index 0000000..ca2fcf8
--- /dev/null
+++ b/.sqlx/query-f51d113d5f026b0b11e086cc5a37578dcc6977ce6eb90a8fc3afe63023598c06.json
@@ -0,0 +1,59 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "select\n                id,\n                workspace_id,\n                name,\n                kind,\n                config_json,\n                to_char(created_at at time zone 'UTC', 'YYYY-MM-DD\"T\"HH24:MI:SS\"Z\"') as \"created_at!\",\n                to_char(updated_at at time zone 'UTC', 'YYYY-MM-DD\"T\"HH24:MI:SS\"Z\"') as \"updated_at!\"\n             from auth_profiles\n             where workspace_id = $1 and id = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 1,
+        "name": "workspace_id",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 2,
+        "name": "name",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 3,
+        "name": "kind",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 4,
+        "name": "config_json",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 5,
+        "name": "created_at!",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 6,
+        "name": "updated_at!",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      false,
+      false,
+      null,
+      null
+    ]
+  },
+  "hash": "f51d113d5f026b0b11e086cc5a37578dcc6977ce6eb90a8fc3afe63023598c06"
+}
diff --git a/crates/crank-registry/src/postgres/auth.rs b/crates/crank-registry/src/postgres/auth.rs
index 36e53fb..8ca803b 100644
--- a/crates/crank-registry/src/postgres/auth.rs
+++ b/crates/crank-registry/src/postgres/auth.rs
@@ -395,48 +395,71 @@ impl PostgresRegistry {
         workspace_id: &WorkspaceId,
         auth_profile_id: &crank_core::AuthProfileId,
     ) -> Result<Option<AuthProfile>, RegistryError> {
-        let row = sqlx::query(
+        let row = sqlx::query!(
             "select
                 id,
                 workspace_id,
                 name,
                 kind,
                 config_json,
-                to_char(created_at at time zone 'UTC', 'YYYY-MM-DD\"T\"HH24:MI:SS\"Z\"') as created_at,
-                to_char(updated_at at time zone 'UTC', 'YYYY-MM-DD\"T\"HH24:MI:SS\"Z\"') as updated_at
+                to_char(created_at at time zone 'UTC', 'YYYY-MM-DD\"T\"HH24:MI:SS\"Z\"') as \"created_at!\",
+                to_char(updated_at at time zone 'UTC', 'YYYY-MM-DD\"T\"HH24:MI:SS\"Z\"') as \"updated_at!\"
              from auth_profiles
              where workspace_id = $1 and id = $2",
+            workspace_id.as_str(),
+            auth_profile_id.as_str(),
         )
-        .bind(workspace_id.as_str())
-        .bind(auth_profile_id.as_str())
         .fetch_optional(&self.pool)
         .await?;
 
-        row.as_ref().map(map_auth_profile).transpose()
+        row.map(|row| {
+            build_auth_profile(
+                row.id,
+                row.workspace_id,
+                row.name,
+                row.kind,
+                row.config_json,
+                row.created_at,
+                row.updated_at,
+            )
+        })
+        .transpose()
     }
 
     pub async fn list_auth_profiles(
         &self,
         workspace_id: &WorkspaceId,
     ) -> Result<Vec<AuthProfile>, RegistryError> {
-        let rows = sqlx::query(
+        let rows = sqlx::query!(
             "select
                 id,
                 workspace_id,
                 name,
                 kind,
                 config_json,
-                to_char(created_at at time zone 'UTC', 'YYYY-MM-DD\"T\"HH24:MI:SS\"Z\"') as created_at,
-                to_char(updated_at at time zone 'UTC', 'YYYY-MM-DD\"T\"HH24:MI:SS\"Z\"') as updated_at
+                to_char(created_at at time zone 'UTC', 'YYYY-MM-DD\"T\"HH24:MI:SS\"Z\"') as \"created_at!\",
+                to_char(updated_at at time zone 'UTC', 'YYYY-MM-DD\"T\"HH24:MI:SS\"Z\"') as \"updated_at!\"
              from auth_profiles
              where workspace_id = $1
              order by name asc",
+            workspace_id.as_str(),
         )
-        .bind(workspace_id.as_str())
         .fetch_all(&self.pool)
         .await?;
 
-        rows.iter().map(map_auth_profile).collect()
+        rows.into_iter()
+            .map(|row| {
+                build_auth_profile(
+                    row.id,
+                    row.workspace_id,
+                    row.name,
+                    row.kind,
+                    row.config_json,
+                    row.created_at,
+                    row.updated_at,
+                )
+            })
+            .collect()
     }
 
     pub async fn list_auth_profiles_referencing_secret(
diff --git a/crates/crank-registry/src/postgres/mod.rs b/crates/crank-registry/src/postgres/mod.rs
index ef92a23..d39c21e 100644
--- a/crates/crank-registry/src/postgres/mod.rs
+++ b/crates/crank-registry/src/postgres/mod.rs
@@ -665,18 +665,6 @@ fn map_operation_agent_ref(row: &PgRow) -> Result<OperationAgentRef, RegistryErr
     })
 }
 
-fn map_auth_profile(row: &PgRow) -> Result<AuthProfile, RegistryError> {
-    Ok(AuthProfile {
-        id: crank_core::AuthProfileId::new(row.try_get::<String, _>("id")?),
-        workspace_id: WorkspaceId::new(row.try_get::<String, _>("workspace_id")?),
-        name: row.try_get("name")?,
-        kind: deserialize_enum_text(&row.try_get::<String, _>("kind")?, "kind")?,
-        config: deserialize_json_value(row.try_get::<Json<Value>, _>("config_json")?.0)?,
-        created_at: row.try_get("created_at")?,
-        updated_at: row.try_get("updated_at")?,
-    })
-}
-
 fn map_agent_binding(row: &PgRow) -> Result<AgentOperationBinding, RegistryError> {
     Ok(AgentOperationBinding {
         operation_id: OperationId::new(row.try_get::<String, _>("operation_id")?),
@@ -758,6 +746,26 @@ fn build_operation_summary(
     })
 }
 
+fn build_auth_profile(
+    id: String,
+    workspace_id: String,
+    name: String,
+    kind: String,
+    config_json: Value,
+    created_at: String,
+    updated_at: String,
+) -> Result<AuthProfile, RegistryError> {
+    Ok(AuthProfile {
+        id: crank_core::AuthProfileId::new(id),
+        workspace_id: WorkspaceId::new(workspace_id),
+        name,
+        kind: deserialize_enum_text(&kind, "kind")?,
+        config: deserialize_json_value(config_json)?,
+        created_at,
+        updated_at,
+    })
+}
+
 fn build_agent_version_record(
     summary: &AgentSummary,
     version: i32,