diff --git a/auth/token.go b/auth/token.go
index 613a76789..b286bc943 100644
--- a/auth/token.go
+++ b/auth/token.go
@@ -13,14 +13,14 @@ type (
 )
 
 func (svc tokenService) SearchByUserID(ctx context.Context, userID uint64) (types.AuthOa2tokenSet, error) {
-	set, _, err := svc.store.SearchAuthOa2tokens(ctx, types.AuthOa2tokenFilter{UserID: userID})
+	set, _, err := store.SearchAuthOa2tokens(ctx, svc.store, types.AuthOa2tokenFilter{UserID: userID})
 	return set, err
 }
 
 func (svc tokenService) DeleteByID(ctx context.Context, ID uint64) error {
-	return svc.store.DeleteAuthOa2tokenByID(ctx, ID)
+	return store.DeleteAuthOa2tokenByID(ctx, svc.store, ID)
 }
 
 func (svc tokenService) DeleteByUserID(ctx context.Context, userID uint64) error {
-	return svc.store.DeleteAuthOA2TokenByUserID(ctx, userID)
+	return store.DeleteAuthOA2TokenByUserID(ctx, svc.store, userID)
 }
diff --git a/automation/service/access_control.gen.go b/automation/service/access_control.gen.go
index 7b729e83c..a5c074bae 100644
--- a/automation/service/access_control.gen.go
+++ b/automation/service/access_control.gen.go
@@ -102,7 +102,7 @@ func (svc accessControl) Trace(ctx context.Context, userID uint64, roles []uint6
 			return nil, fmt.Errorf("userID and roles are mutually exclusive")
 		}
 
-		members, _, err = svc.store.SearchRoleMembers(ctx, systemTypes.RoleMemberFilter{UserID: userID})
+		members, _, err = store.SearchRoleMembers(ctx, svc.store, systemTypes.RoleMemberFilter{UserID: userID})
 		if err != nil {
 			return nil, err
 		}
diff --git a/automation/service/session.go b/automation/service/session.go
index efc3f81f7..e623e3bdb 100644
--- a/automation/service/session.go
+++ b/automation/service/session.go
@@ -488,7 +488,7 @@ func (svc *session) stateChangeHandler(ctx context.Context) wfexec.StateChangeHa
 
 		ses.CopyRuntimeStacktrace()
 
-		if err := svc.store.UpsertAutomationSession(ctx, ses); err != nil {
+		if err := store.UpsertAutomationSession(ctx, svc.store, ses); err != nil {
 			log.Error("failed to update session", zap.Error(err))
 		}
 	}
diff --git a/codegen/assets/templates/gocode/rbac/$component_access_control.go.tpl b/codegen/assets/templates/gocode/rbac/$component_access_control.go.tpl
index e9052af57..d3c834114 100644
--- a/codegen/assets/templates/gocode/rbac/$component_access_control.go.tpl
+++ b/codegen/assets/templates/gocode/rbac/$component_access_control.go.tpl
@@ -101,7 +101,7 @@ func (svc accessControl) Trace(ctx context.Context, userID uint64, roles []uint6
 			return nil, fmt.Errorf("userID and roles are mutually exclusive")
 		}
 
-		members, _, err = svc.store.SearchRoleMembers(ctx, systemTypes.RoleMemberFilter{UserID: userID})
+		members, _, err = store.SearchRoleMembers(ctx, svc.store, systemTypes.RoleMemberFilter{UserID: userID})
 		if err != nil {
 			return nil, err
 		}
diff --git a/compose/service/access_control.gen.go b/compose/service/access_control.gen.go
index 31332e3fe..3924ba03b 100644
--- a/compose/service/access_control.gen.go
+++ b/compose/service/access_control.gen.go
@@ -102,7 +102,7 @@ func (svc accessControl) Trace(ctx context.Context, userID uint64, roles []uint6
 			return nil, fmt.Errorf("userID and roles are mutually exclusive")
 		}
 
-		members, _, err = svc.store.SearchRoleMembers(ctx, systemTypes.RoleMemberFilter{UserID: userID})
+		members, _, err = store.SearchRoleMembers(ctx, svc.store, systemTypes.RoleMemberFilter{UserID: userID})
 		if err != nil {
 			return nil, err
 		}
diff --git a/federation/service/access_control.gen.go b/federation/service/access_control.gen.go
index 8099e8bf2..44194d752 100644
--- a/federation/service/access_control.gen.go
+++ b/federation/service/access_control.gen.go
@@ -102,7 +102,7 @@ func (svc accessControl) Trace(ctx context.Context, userID uint64, roles []uint6
 			return nil, fmt.Errorf("userID and roles are mutually exclusive")
 		}
 
-		members, _, err = svc.store.SearchRoleMembers(ctx, systemTypes.RoleMemberFilter{UserID: userID})
+		members, _, err = store.SearchRoleMembers(ctx, svc.store, systemTypes.RoleMemberFilter{UserID: userID})
 		if err != nil {
 			return nil, err
 		}
diff --git a/federation/service/node.go b/federation/service/node.go
index 7b123c413..13ab482c7 100644
--- a/federation/service/node.go
+++ b/federation/service/node.go
@@ -452,7 +452,7 @@ func (svc node) updater(ctx context.Context, nodeID uint64, action func(...*node
 }
 
 func (svc node) FindBySharedNodeID(ctx context.Context, sharedNodeID uint64) (*types.Node, error) {
-	n, err := svc.store.LookupFederationNodeBySharedNodeID(ctx, sharedNodeID)
+	n, err := store.LookupFederationNodeBySharedNodeID(ctx, svc.store, sharedNodeID)
 
 	if n != nil && !svc.ac.CanManageNode(ctx, n) {
 		return nil, NodeErrNotAllowedToManage()
diff --git a/system/service/access_control.gen.go b/system/service/access_control.gen.go
index a40783ffb..c71d75671 100644
--- a/system/service/access_control.gen.go
+++ b/system/service/access_control.gen.go
@@ -102,7 +102,7 @@ func (svc accessControl) Trace(ctx context.Context, userID uint64, roles []uint6
 			return nil, fmt.Errorf("userID and roles are mutually exclusive")
 		}
 
-		members, _, err = svc.store.SearchRoleMembers(ctx, systemTypes.RoleMemberFilter{UserID: userID})
+		members, _, err = store.SearchRoleMembers(ctx, svc.store, systemTypes.RoleMemberFilter{UserID: userID})
 		if err != nil {
 			return nil, err
 		}
diff --git a/system/service/auth_credentials.go b/system/service/auth_credentials.go
index cdfd0b6ab..c9c494fde 100644
--- a/system/service/auth_credentials.go
+++ b/system/service/auth_credentials.go
@@ -125,7 +125,7 @@ func (svc *auth) loadUserFromToken(ctx context.Context, token, kind string) (u *
 		}
 	)
 
-	return u, svc.store.Tx(ctx, func(ctx context.Context, s store.Storer) (err error) {
+	return u, store.Tx(ctx, svc.store, func(ctx context.Context, s store.Storer) (err error) {
 		credentialsID, credentials := validateToken(token)
 		if credentialsID == 0 {
 			return AuthErrInvalidToken(aam)
@@ -179,7 +179,7 @@ func (svc *auth) createUserToken(ctx context.Context, u *types.User, kind string
 		}
 	)
 
-	err = svc.store.Tx(ctx, func(ctx context.Context, s store.Storer) (err error) {
+	err = store.Tx(ctx, svc.store, func(ctx context.Context, s store.Storer) (err error) {
 		if u == nil || u.ID == 0 {
 			return AuthErrGeneric()
 		}
@@ -722,7 +722,7 @@ func (svc *auth) RemoveAccessTokens(ctx context.Context, user *types.User) error
 		ctx,
 		&authActionProps{user: user},
 		AuthActionAccessTokensRemoved,
-		svc.store.DeleteAuthOA2TokenByUserID(ctx, user.ID),
+		store.DeleteAuthOA2TokenByUserID(ctx, svc.store, user.ID),
 	)
 }
 
@@ -737,7 +737,7 @@ func (svc *auth) ValidateTOTP(ctx context.Context, code string) (err error) {
 		i    = internalAuth.GetIdentityFromContext(ctx)
 	)
 
-	err = svc.store.Tx(ctx, func(ctx context.Context, s store.Storer) error {
+	err = store.Tx(ctx, svc.store, func(ctx context.Context, s store.Storer) error {
 		if !svc.settings.Auth.MultiFactor.TOTP.Enabled {
 			return AuthErrDisabledMFAWithTOTP()
 		}
@@ -776,7 +776,7 @@ func (svc *auth) ConfigureTOTP(ctx context.Context, secret string, code string)
 		i    = internalAuth.GetIdentityFromContext(ctx)
 	)
 
-	err = svc.store.Tx(ctx, func(ctx context.Context, s store.Storer) error {
+	err = store.Tx(ctx, svc.store, func(ctx context.Context, s store.Storer) error {
 		if !svc.settings.Auth.MultiFactor.TOTP.Enabled {
 			return AuthErrDisabledMFAWithTOTP()
 		}
@@ -837,7 +837,7 @@ func (svc *auth) RemoveTOTP(ctx context.Context, userID uint64, code string) (u
 		self = i != nil && i.Identity() == userID
 	)
 
-	err = svc.store.Tx(ctx, func(ctx context.Context, s store.Storer) error {
+	err = store.Tx(ctx, svc.store, func(ctx context.Context, s store.Storer) error {
 		if !svc.settings.Auth.MultiFactor.TOTP.Enabled {
 			return AuthErrDisabledMFAWithTOTP()
 		}
@@ -945,7 +945,7 @@ func (svc *auth) SendEmailOTP(ctx context.Context) (err error) {
 		i    = internalAuth.GetIdentityFromContext(ctx)
 	)
 
-	err = svc.store.Tx(ctx, func(ctx context.Context, s store.Storer) (err error) {
+	err = store.Tx(ctx, svc.store, func(ctx context.Context, s store.Storer) (err error) {
 		if !svc.settings.Auth.MultiFactor.EmailOTP.Enabled {
 			return AuthErrDisabledMFAWithEmailOTP()
 		}
@@ -977,7 +977,7 @@ func (svc *auth) ConfigureEmailOTP(ctx context.Context, userID uint64, enable bo
 		aam  = &authActionProps{credentials: &types.Credential{Kind: kind}}
 	)
 
-	err = svc.store.Tx(ctx, func(ctx context.Context, s store.Storer) (err error) {
+	err = store.Tx(ctx, svc.store, func(ctx context.Context, s store.Storer) (err error) {
 		if !svc.settings.Auth.MultiFactor.EmailOTP.Enabled {
 			return AuthErrDisabledMFAWithEmailOTP()
 		}
@@ -1010,7 +1010,7 @@ func (svc *auth) ValidateEmailOTP(ctx context.Context, code string) (err error)
 		i    = internalAuth.GetIdentityFromContext(ctx)
 	)
 
-	err = svc.store.Tx(ctx, func(ctx context.Context, s store.Storer) error {
+	err = store.Tx(ctx, svc.store, func(ctx context.Context, s store.Storer) error {
 		if !svc.settings.Auth.MultiFactor.EmailOTP.Enabled {
 			return AuthErrDisabledMFAWithEmailOTP()
 		}
diff --git a/system/service/auth_test.go b/system/service/auth_test.go
index f5231bb6d..c4e7e4ae7 100644
--- a/system/service/auth_test.go
+++ b/system/service/auth_test.go
@@ -104,8 +104,8 @@ func TestAuth_External(t *testing.T) {
 
 	svc := makeMockAuthService()
 	svc.settings.Auth.External.Enabled = true
-	req.NoError(svc.store.TruncateUsers(ctx))
-	req.NoError(svc.store.TruncateCredentials(ctx))
+	req.NoError(store.TruncateUsers(ctx, svc.store))
+	req.NoError(store.TruncateCredentials(ctx, svc.store))
 	req.NoError(store.CreateUser(ctx, svc.store, validUser, suspendedUser))
 	req.NoError(store.CreateCredential(ctx, svc.store, fooCredentials, barCredentials))
 
@@ -147,7 +147,7 @@ func TestAuth_InternalSignUp(t *testing.T) {
 	svc.settings.Auth.Internal.Enabled = true
 	svc.settings.Auth.Internal.Signup.Enabled = true
 
-	req.NoError(svc.store.CreateUser(ctx, &types.User{Email: "existing@internal-signup-test.tld", ID: existingUserID, CreatedAt: *now()}))
+	req.NoError(store.CreateUser(ctx, svc.store, &types.User{Email: "existing@internal-signup-test.tld", ID: existingUserID, CreatedAt: *now()}))
 	req.NoError(svc.SetPassword(ctx, existingUserID, "secure password"))
 
 	t.Run("invalid email", func(t *testing.T) {
@@ -262,8 +262,8 @@ func TestAuth_InternalLogin(t *testing.T) {
 
 	svc := makeMockAuthService()
 	svc.settings.Auth.Internal.Enabled = true
-	req.NoError(svc.store.TruncateUsers(ctx))
-	req.NoError(svc.store.TruncateCredentials(ctx))
+	req.NoError(store.TruncateUsers(ctx, svc.store))
+	req.NoError(store.TruncateCredentials(ctx, svc.store))
 	req.NoError(store.CreateUser(ctx, svc.store, validUser, suspendedUser))
 	req.NoError(svc.SetPasswordCredentials(ctx, validUser.ID, validPass))
 
@@ -321,8 +321,8 @@ func TestAuth_createUserToken(t *testing.T) {
 	)
 
 	svc := makeMockAuthService()
-	req.NoError(svc.store.TruncateUsers(ctx))
-	req.NoError(svc.store.TruncateCredentials(ctx))
+	req.NoError(store.TruncateUsers(ctx, svc.store))
+	req.NoError(store.TruncateCredentials(ctx, svc.store))
 	req.NoError(store.CreateUser(ctx, svc.store, validUser))
 
 	for _, tt := range tests {
@@ -367,8 +367,8 @@ func TestAuth_multiCreateUserTokenForPasswordReset(t *testing.T) {
 		}
 	)
 
-	req.NoError(svc.store.TruncateUsers(ctx))
-	req.NoError(svc.store.TruncateCredentials(ctx))
+	req.NoError(store.TruncateUsers(ctx, svc.store))
+	req.NoError(store.TruncateCredentials(ctx, svc.store))
 	req.NoError(store.CreateUser(ctx, svc.store, validUser))
 
 	for try := 0; try <= tokenReqMaxCount+1; try++ {
diff --git a/system/service/queue.go b/system/service/queue.go
index 6629236c4..406c8c28f 100644
--- a/system/service/queue.go
+++ b/system/service/queue.go
@@ -45,7 +45,7 @@ func (svc *queue) CreateQueueEvent(q string, p []byte) eventbus.Event {
 }
 
 func (svc *queue) ProcessQueueMessage(ctx context.Context, ID uint64, m mt.QueueMessage) error {
-	svc.store.UpdateQueueMessage(ctx, &types.QueueMessage{
+	store.UpdateQueueMessage(ctx, svc.store, &types.QueueMessage{
 		ID:        ID,
 		Processed: now(),
 		Queue:     m.Queue,
@@ -56,7 +56,7 @@ func (svc *queue) ProcessQueueMessage(ctx context.Context, ID uint64, m mt.Queue
 }
 
 func (svc *queue) CreateQueueMessage(ctx context.Context, m mt.QueueMessage) error {
-	svc.store.CreateQueueMessage(ctx, &types.QueueMessage{
+	store.CreateQueueMessage(ctx, svc.store, &types.QueueMessage{
 		ID:      nextID(),
 		Created: now(),
 		Queue:   m.Queue,
@@ -67,7 +67,7 @@ func (svc *queue) CreateQueueMessage(ctx context.Context, m mt.QueueMessage) err
 }
 
 func (svc *queue) SearchQueues(ctx context.Context, ff mt.QueueFilter) (l []mt.QueueDb, f mt.QueueFilter, err error) {
-	list, _, err := svc.store.SearchQueues(ctx, *(makeFilter(&ff)))
+	list, _, err := store.SearchQueues(ctx, svc.store, *(makeFilter(&ff)))
 
 	if err != nil {
 		return
diff --git a/system/service/statistics.go b/system/service/statistics.go
index 1bdcb9e3b..5c44f2317 100644
--- a/system/service/statistics.go
+++ b/system/service/statistics.go
@@ -45,19 +45,19 @@ func (svc statistics) Metrics(ctx context.Context) (rval *StatisticsMetricsPaylo
 		rval = &StatisticsMetricsPayload{}
 
 		if svc.ac.CanSearchUsers(ctx) {
-			if rval.Users, err = svc.store.UserMetrics(ctx); err != nil {
+			if rval.Users, err = store.UserMetrics(ctx, svc.store); err != nil {
 				return err
 			}
 		}
 
 		if svc.ac.CanSearchRoles(ctx) {
-			if rval.Roles, err = svc.store.RoleMetrics(ctx); err != nil {
+			if rval.Roles, err = store.RoleMetrics(ctx, svc.store); err != nil {
 				return err
 			}
 		}
 
 		if svc.ac.CanSearchApplications(ctx) {
-			if rval.Applications, err = svc.store.ApplicationMetrics(ctx); err != nil {
+			if rval.Applications, err = store.ApplicationMetrics(ctx, svc.store); err != nil {
 				return err
 			}
 		}
diff --git a/system/service/user.go b/system/service/user.go
index 6ddd235db..3484af314 100644
--- a/system/service/user.go
+++ b/system/service/user.go
@@ -758,7 +758,7 @@ func (svc user) DeleteAuthTokensByUserID(ctx context.Context, userID uint64) (er
 			return UserErrInvalidID()
 		}
 
-		if err = svc.store.DeleteAuthOA2TokenByUserID(ctx, userID); err != nil {
+		if err = store.DeleteAuthOA2TokenByUserID(ctx, svc.store, userID); err != nil {
 			return
 		}
 
@@ -779,7 +779,7 @@ func (svc user) DeleteAuthSessionsByUserID(ctx context.Context, userID uint64) (
 			return UserErrInvalidID()
 		}
 
-		if err = svc.store.DeleteAuthSessionsByUserID(ctx, userID); err != nil {
+		if err = store.DeleteAuthSessionsByUserID(ctx, svc.store, userID); err != nil {
 			return
 		}