diff --git a/packages/plugins/@tachybase/plugin-share/src/server/migrations/20240722114514-add-guest-specialRole.ts b/packages/plugins/@tachybase/plugin-share/src/server/migrations/20240722114514-add-guest-specialRole.ts
new file mode 100644
index 000000000..8929cc3f0
--- /dev/null
+++ b/packages/plugins/@tachybase/plugin-share/src/server/migrations/20240722114514-add-guest-specialRole.ts
@@ -0,0 +1,28 @@
+import { Migration } from '@tachybase/server';
+
+export default class AddGuestSpecialRoleMigration extends Migration {
+  appVersion = '<0.21.88';
+
+  async up() {
+    const repo = this.context.db.getRepository('users');
+    const user = await repo.findOne({
+      filter: {
+        username: 'guest',
+      },
+    });
+    if (user) {
+      await repo.update({
+        values: {
+          specialRole: 'guest',
+        },
+        filter: {
+          id: user.id,
+        },
+      });
+    } else {
+      throw new Error('Guest user not found');
+    }
+  }
+
+  async down() {}
+}
diff --git a/packages/plugins/@tachybase/plugin-share/src/server/plugin.ts b/packages/plugins/@tachybase/plugin-share/src/server/plugin.ts
index 0804f5f9a..18bf6de89 100644
--- a/packages/plugins/@tachybase/plugin-share/src/server/plugin.ts
+++ b/packages/plugins/@tachybase/plugin-share/src/server/plugin.ts
@@ -27,7 +27,7 @@ export class PluginShareServer extends Plugin {
     this.app.acl.addFixedParams('users', 'destroy', () => {
       return {
         filter: {
-          'username.$ne': 'guest',
+          'specialRole.$ne': 'guest',
         },
       };
     });
@@ -99,6 +99,7 @@ export class PluginShareServer extends Plugin {
         password: guestPassword,
         nickname: guestNickname,
         username: guestUsername,
+        specialRole: 'guest',
       },
     });
 
diff --git a/packages/plugins/@tachybase/plugin-users/src/server/collections/users.ts b/packages/plugins/@tachybase/plugin-users/src/server/collections/users.ts
index 7e33d2d03..b55e904df 100644
--- a/packages/plugins/@tachybase/plugin-users/src/server/collections/users.ts
+++ b/packages/plugins/@tachybase/plugin-users/src/server/collections/users.ts
@@ -98,5 +98,9 @@ export default defineCollection({
       name: 'systemSettings',
       defaultValue: {},
     },
+    {
+      type: 'string',
+      name: 'specialRole',
+    },
   ],
 });
diff --git a/packages/plugins/@tachybase/plugin-users/src/server/migrations/20240722114514-add-users-specialRole.ts b/packages/plugins/@tachybase/plugin-users/src/server/migrations/20240722114514-add-users-specialRole.ts
new file mode 100644
index 000000000..6144b86f3
--- /dev/null
+++ b/packages/plugins/@tachybase/plugin-users/src/server/migrations/20240722114514-add-users-specialRole.ts
@@ -0,0 +1,55 @@
+import { DataTypes } from '@tachybase/database';
+import { Migration } from '@tachybase/server';
+
+export default class AddUsersSpecialRoleMigration extends Migration {
+  on = 'beforeLoad';
+  appVersion = '<0.21.88';
+
+  async up() {
+    const collection = this.db.collection({
+      name: 'users',
+      fields: [
+        {
+          type: 'string',
+          name: 'specialRole',
+        },
+      ],
+    });
+    const tableNameWithSchema = collection.getTableNameWithSchema();
+    const field = collection.getField('specialRole');
+    const exists = await field.existsInDb();
+    if (!exists) {
+      await this.db.sequelize.getQueryInterface().addColumn(tableNameWithSchema, field.columnName(), {
+        type: DataTypes.STRING,
+      });
+    }
+    try {
+      await this.db.sequelize.getQueryInterface().addConstraint(tableNameWithSchema, {
+        type: 'unique',
+        fields: [field.columnName()],
+      });
+    } catch (error) {
+      throw new Error(error);
+    }
+    const repo = this.context.db.getRepository('users');
+    const user = await repo.findOne({
+      filter: {
+        email: process.env.INIT_ROOT_EMAIL || 'admin@tachybase.com',
+      },
+    });
+    if (user) {
+      await repo.update({
+        values: {
+          specialRole: 'root',
+        },
+        filter: {
+          id: user.id,
+        },
+      });
+    } else {
+      throw new Error('Root user not found');
+    }
+  }
+
+  async down() {}
+}
diff --git a/packages/plugins/@tachybase/plugin-users/src/server/server.ts b/packages/plugins/@tachybase/plugin-users/src/server/server.ts
index d7151129a..a227e1113 100644
--- a/packages/plugins/@tachybase/plugin-users/src/server/server.ts
+++ b/packages/plugins/@tachybase/plugin-users/src/server/server.ts
@@ -96,7 +96,7 @@ export default class PluginUsersServer extends Plugin {
     this.app.acl.addFixedParams('users', 'destroy', () => {
       return {
         filter: {
-          'id.$ne': 1,
+          'specialRole.$ne': 'root',
         },
       };
     });
@@ -175,6 +175,7 @@ export default class PluginUsersServer extends Plugin {
         password: rootPassword,
         nickname: rootNickname,
         username: rootUsername,
+        specialRole: 'root',
       },
     });