diff --git a/sql/002_seed_glossary.sql b/sql/002_seed_glossary.sql
new file mode 100644
index 0000000..fe121ab
--- /dev/null
+++ b/sql/002_seed_glossary.sql
@@ -0,0 +1,37 @@
+-- CF-3127: seed per-tenant glossary terms derived from memory/*.md feedback rules.
+-- Idempotent via ON CONFLICT on the uq_glossary_term_tenant partial unique index.
+
+BEGIN;
+
+INSERT INTO glossary_terms (id, customer_id, tenant, source_term, target_term, source_lang, target_lang, is_dnt, notes, created_at)
+VALUES
+  -- clicksports.de: "Support" is forbidden; always translate/map to "Service"
+  -- (uq index doesn't include source_lang, so only one (tenant, term, target_lang) row)
+  (gen_random_uuid(), NULL, 'clicksports.de', 'Support', 'Service', 'de', 'de', false, 'House style: never "Support" (applies to any source lang targeting DE)', now()),
+  (gen_random_uuid(), NULL, 'clicksports.de', 'Support-Ticket', 'Service-Ticket', 'de', 'de', false, 'House style', now()),
+
+  -- vpn-marketing: rewrite-targets for forbidden_terms
+  (gen_random_uuid(), NULL, 'vpn-marketing', 'Hetzner', 'Cloud-Server in Deutschland', 'de', 'de', false, 'Never name the hoster', now()),
+  (gen_random_uuid(), NULL, 'vpn-marketing', 'Hetzner', 'Cloud server in Germany', 'de', 'en', false, 'Never name the hoster', now()),
+  (gen_random_uuid(), NULL, 'vpn-marketing', 'AdGuardHome', 'curated blocklists (HaGeZi, OISD, Cloudflare top-10k allowlist)', 'de', 'de', false, 'Do not name AdGuardHome', now()),
+  (gen_random_uuid(), NULL, 'vpn-marketing', 'AdGuardHome', 'curated blocklists (HaGeZi, OISD, Cloudflare top-10k allowlist)', 'en', 'en', false, 'Do not name AdGuardHome', now()),
+
+  -- ifk: brand name as DNT
+  (gen_random_uuid(), NULL, 'ifk', 'Internet for Kids', 'Internet for Kids', 'en', 'de', true, 'Brand name; never translate', now()),
+  (gen_random_uuid(), NULL, 'ifk', 'Internet for Kids', 'Internet for Kids', 'en', 'fr', true, 'Brand name; never translate', now()),
+
+  -- matrixhost: brand DNT
+  (gen_random_uuid(), NULL, 'matrixhost', 'MatrixHost', 'MatrixHost', 'en', 'de', true, 'Brand', now()),
+  (gen_random_uuid(), NULL, 'matrixhost', 'Matrix', 'Matrix', 'en', 'de', true, 'Protocol name', now()),
+
+  -- agiliton: brand DNT
+  (gen_random_uuid(), NULL, 'agiliton', 'Agiliton', 'Agiliton', 'de', 'en', true, 'Brand', now()),
+
+  -- etoro: platform/brand DNT
+  (gen_random_uuid(), NULL, 'etoro', 'eToro', 'eToro', 'en', 'de', true, 'Brand', now()),
+  (gen_random_uuid(), NULL, 'etoro', 'eToro', 'eToro', 'en', 'fr', true, 'Brand', now()),
+  (gen_random_uuid(), NULL, 'etoro', 'CopyTrading', 'CopyTrading', 'en', 'de', true, 'Product name', now())
+ON CONFLICT (tenant, LOWER(source_term), target_lang, COALESCE(context_hint, '')) WHERE tenant IS NOT NULL
+DO UPDATE SET target_term = EXCLUDED.target_term, is_dnt = EXCLUDED.is_dnt, notes = EXCLUDED.notes, updated_at = now();
+
+COMMIT;