diff --git a/compose/keycloak/portable-agent-realm.json b/compose/keycloak/portable-agent-realm.json
index 8960089..9554351 100644
--- a/compose/keycloak/portable-agent-realm.json
+++ b/compose/keycloak/portable-agent-realm.json
@@ -315,6 +315,7 @@
       "attributes": {
         "tenant_id": ["${ACTION_SERVICE_TENANT_ID}"]
       },
+      "realmRoles": ["offline_access"],
       "requiredActions": [],
       "credentials": [
         {
diff --git a/scripts/check-compose.ps1 b/scripts/check-compose.ps1
index 963fe0a..894bfec 100644
--- a/scripts/check-compose.ps1
+++ b/scripts/check-compose.ps1
@@ -89,6 +89,9 @@ $localUser = $realm.users | Where-Object username -eq "local-user"
 if (-not $localUser.email -or -not $localUser.emailVerified) {
     throw "Профиль local-user не готов для входа."
 }
+if (@($localUser.realmRoles) -notcontains "offline_access") {
+    throw "Профиль local-user не может получить offline refresh token для Device Flow."
+}
 $composeText = Get-Content -Raw -LiteralPath "compose/compose.yaml"
 if ($composeText -notmatch '(?ms)^  keycloak:.*?^    healthcheck:') {
     throw "У Keycloak нет readiness healthcheck."