diff --git a/crates/buzz-db/src/store/community_auth.rs b/crates/buzz-db/src/store/community_auth.rs
index da65559ecc..6f08b8ef33 100644
--- a/crates/buzz-db/src/store/community_auth.rs
+++ b/crates/buzz-db/src/store/community_auth.rs
@@ -83,7 +83,7 @@ impl PolicyRecord {
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub enum PolicyOutcome {
     /// Durable acceptance or identical read-only replay.
-    Accepted(PolicyRecord),
+    Accepted(Box<PolicyRecord>),
     /// No mutation or receipt was committed.
     Refused(&'static str),
 }
@@ -353,7 +353,7 @@ impl Db {
                 .write_community_nip_fi_policy(request, None, configured_trust)
                 .await?
             {
-                PolicyOutcome::Accepted(record) => UpgradeOutcome::Accepted(record.legacy()),
+                PolicyOutcome::Accepted(record) => UpgradeOutcome::Accepted((*record).legacy()),
                 PolicyOutcome::Refused(code) => UpgradeOutcome::Refused(code),
             },
         )
@@ -365,7 +365,7 @@ impl Db {
         intent: Option<(bool, i64, bool)>,
         configured_trust: std::result::Result<(), &'static str>,
     ) -> Result<PolicyOutcome> {
-        let desired = intent.map_or(true, |i| i.0);
+        let desired = intent.is_none_or(|i| i.0);
         let expected_generation = intent.map(|i| i.1);
         let expected_state = intent.map(|i| i.2);
         let connection = crate::observability::acquire_writer(
@@ -394,7 +394,7 @@ impl Db {
                     && record.expected_policy_generation == expected_generation
                     && record.expected_requires_nip_fi == expected_state
                 {
-                    PolicyOutcome::Accepted(record)
+                    PolicyOutcome::Accepted(Box::new(record))
                 } else {
                     PolicyOutcome::Refused("idempotency_conflict")
                 },
@@ -522,7 +522,7 @@ impl Db {
             .fetch_one(&mut *tx)
             .await?;
         tx.commit().await?;
-        Ok(PolicyOutcome::Accepted(record))
+        Ok(PolicyOutcome::Accepted(Box::new(record)))
     }
 }
 
diff --git a/crates/buzz-db/src/store/community_auth/postgres_tests.rs b/crates/buzz-db/src/store/community_auth/postgres_tests.rs
index ee6354becd..e4aff87ecb 100644
--- a/crates/buzz-db/src/store/community_auth/postgres_tests.rs
+++ b/crates/buzz-db/src/store/community_auth/postgres_tests.rs
@@ -581,7 +581,7 @@ async fn apply(db: &Db, request: &PolicyRequest) -> PolicyRecord {
     else {
         panic!("policy refused")
     };
-    record
+    *record
 }
 
 #[tokio::test]
@@ -609,7 +609,7 @@ async fn policy_enable_disable_reenable_history_and_identity() {
         db.set_community_nip_fi_policy(&enable, Err("upgrades_disabled"))
             .await
             .unwrap(),
-        PolicyOutcome::Accepted(old)
+        PolicyOutcome::Accepted(Box::new(old))
     );
     let reenable = intent(&tuple, true, 2, false);
     let third = apply(&db, &reenable).await;
diff --git a/crates/buzz-relay/src/api/operator/community_policy.rs b/crates/buzz-relay/src/api/operator/community_policy.rs
index ecf86985fb..7e6c61d5be 100644
--- a/crates/buzz-relay/src/api/operator/community_policy.rs
+++ b/crates/buzz-relay/src/api/operator/community_policy.rs
@@ -136,7 +136,7 @@ pub async fn set_community_nip_fi_policy(
                 buzz_core::CommunityId::from_uuid(record.acceptance.community_id),
                 &record.acceptance.expected_host,
             ));
-            Ok(response(&state, record))
+            Ok(response(&state, *record))
         }
         PolicyOutcome::Refused(code) => Err(coded_api_error(
             match code {