diff --git a/.nvmrc b/.nvmrc
index 744ca17ec0..5d621bb2fe 100644
--- a/.nvmrc
+++ b/.nvmrc
@@ -1 +1 @@
-22.14
+22.15
diff --git a/app/javascript/mastodon/locales/de.json b/app/javascript/mastodon/locales/de.json
index 4a86c46f28..e6eb25ec2d 100644
--- a/app/javascript/mastodon/locales/de.json
+++ b/app/javascript/mastodon/locales/de.json
@@ -56,8 +56,8 @@
   "account.mute_notifications_short": "Benachrichtigungen stummschalten",
   "account.mute_short": "Stummschalten",
   "account.muted": "Stummgeschaltet",
-  "account.muting": "Wird stummgeschaltet",
-  "account.mutual": "Ihr folgt euch",
+  "account.muting": "Stummgeschaltet",
+  "account.mutual": "Ihr folgt einander",
   "account.no_bio": "Keine Beschreibung verfügbar.",
   "account.open_original_page": "Ursprüngliche Seite öffnen",
   "account.posts": "Beiträge",
diff --git a/app/models/web/push_subscription.rb b/app/models/web/push_subscription.rb
index 12d843cd09..25140598a5 100644
--- a/app/models/web/push_subscription.rb
+++ b/app/models/web/push_subscription.rb
@@ -12,13 +12,13 @@
 #  standard        :boolean          default(FALSE), not null
 #  created_at      :datetime         not null
 #  updated_at      :datetime         not null
-#  access_token_id :bigint(8)
-#  user_id         :bigint(8)
+#  access_token_id :bigint(8)        not null
+#  user_id         :bigint(8)        not null
 #
 
 class Web::PushSubscription < ApplicationRecord
-  belongs_to :user, optional: true
-  belongs_to :access_token, class_name: 'Doorkeeper::AccessToken', optional: true
+  belongs_to :user
+  belongs_to :access_token, class_name: 'Doorkeeper::AccessToken'
 
   has_one :session_activation, foreign_key: 'web_push_subscription_id', inverse_of: :web_push_subscription, dependent: nil
 
@@ -28,7 +28,7 @@ class Web::PushSubscription < ApplicationRecord
 
   validates_with WebPushKeyValidator
 
-  delegate :locale, to: :associated_user
+  delegate :locale, to: :user
 
   generates_token_for :unsubscribe, expires_in: Web::PushNotificationWorker::TTL
 
@@ -36,24 +36,8 @@ class Web::PushSubscription < ApplicationRecord
     policy_allows_notification?(notification) && alert_enabled_for_notification_type?(notification)
   end
 
-  def associated_user
-    return @associated_user if defined?(@associated_user)
-
-    @associated_user = if user_id.nil?
-                         session_activation.user
-                       else
-                         user
-                       end
-  end
-
   def associated_access_token
-    return @associated_access_token if defined?(@associated_access_token)
-
-    @associated_access_token = if access_token_id.nil?
-                                 find_or_create_access_token.token
-                               else
-                                 access_token.token
-                               end
+    access_token.token
   end
 
   class << self
@@ -65,16 +49,6 @@ class Web::PushSubscription < ApplicationRecord
 
   private
 
-  def find_or_create_access_token
-    Doorkeeper::AccessToken.find_or_create_for(
-      application: Doorkeeper::Application.find_by(superapp: true),
-      resource_owner: user_id || session_activation.user_id,
-      scopes: Doorkeeper::OAuth::Scopes.from_string('read write follow push'),
-      expires_in: Doorkeeper.configuration.access_token_expires_in,
-      use_refresh_token: Doorkeeper.configuration.refresh_token_enabled?
-    )
-  end
-
   def alert_enabled_for_notification_type?(notification)
     truthy?(data&.dig('alerts', notification.type.to_s))
   end
diff --git a/app/serializers/web/notification_serializer.rb b/app/serializers/web/notification_serializer.rb
index fb2f7248a6..1c2b26bf5b 100644
--- a/app/serializers/web/notification_serializer.rb
+++ b/app/serializers/web/notification_serializer.rb
@@ -13,7 +13,7 @@ class Web::NotificationSerializer < ActiveModel::Serializer
   end
 
   def preferred_locale
-    current_push_subscription.associated_user&.locale || I18n.default_locale
+    current_push_subscription.user&.locale || I18n.default_locale
   end
 
   def notification_id
diff --git a/db/migrate/20250422083912_add_not_null_to_web_push_subscription_user.rb b/db/migrate/20250422083912_add_not_null_to_web_push_subscription_user.rb
new file mode 100644
index 0000000000..2af08edc40
--- /dev/null
+++ b/db/migrate/20250422083912_add_not_null_to_web_push_subscription_user.rb
@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+class AddNotNullToWebPushSubscriptionUser < ActiveRecord::Migration[8.0]
+  def change
+    add_check_constraint :web_push_subscriptions, 'user_id IS NOT NULL', name: 'web_push_subscriptions_user_id_null', validate: false
+  end
+end
diff --git a/db/migrate/20250422084214_validate_add_not_null_to_web_push_subscription_user.rb b/db/migrate/20250422084214_validate_add_not_null_to_web_push_subscription_user.rb
new file mode 100644
index 0000000000..af1962a8fb
--- /dev/null
+++ b/db/migrate/20250422084214_validate_add_not_null_to_web_push_subscription_user.rb
@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+class ValidateAddNotNullToWebPushSubscriptionUser < ActiveRecord::Migration[8.0]
+  def up
+    connection.execute(<<~SQL.squish)
+      DELETE FROM web_push_subscriptions
+      WHERE user_id IS NULL
+    SQL
+
+    validate_check_constraint :web_push_subscriptions, name: 'web_push_subscriptions_user_id_null'
+    change_column_null :web_push_subscriptions, :user_id, false
+    remove_check_constraint :web_push_subscriptions, name: 'web_push_subscriptions_user_id_null'
+  end
+
+  def down
+    add_check_constraint :web_push_subscriptions, 'user_id IS NOT NULL', name: 'web_push_subscriptions_user_id_null', validate: false
+    change_column_null :web_push_subscriptions, :user_id, true
+  end
+end
diff --git a/db/migrate/20250422085027_add_not_null_to_web_push_subscription_access_token.rb b/db/migrate/20250422085027_add_not_null_to_web_push_subscription_access_token.rb
new file mode 100644
index 0000000000..167bc71b72
--- /dev/null
+++ b/db/migrate/20250422085027_add_not_null_to_web_push_subscription_access_token.rb
@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+class AddNotNullToWebPushSubscriptionAccessToken < ActiveRecord::Migration[8.0]
+  def change
+    add_check_constraint :web_push_subscriptions, 'access_token_id IS NOT NULL', name: 'web_push_subscriptions_access_token_id_null', validate: false
+  end
+end
diff --git a/db/migrate/20250422085303_validate_add_not_null_to_web_push_subscription_access_token.rb b/db/migrate/20250422085303_validate_add_not_null_to_web_push_subscription_access_token.rb
new file mode 100644
index 0000000000..322d376667
--- /dev/null
+++ b/db/migrate/20250422085303_validate_add_not_null_to_web_push_subscription_access_token.rb
@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+class ValidateAddNotNullToWebPushSubscriptionAccessToken < ActiveRecord::Migration[8.0]
+  def up
+    connection.execute(<<~SQL.squish)
+      DELETE FROM web_push_subscriptions
+      WHERE access_token_id IS NULL
+    SQL
+
+    validate_check_constraint :web_push_subscriptions, name: 'web_push_subscriptions_access_token_id_null'
+    change_column_null :web_push_subscriptions, :access_token_id, false
+    remove_check_constraint :web_push_subscriptions, name: 'web_push_subscriptions_access_token_id_null'
+  end
+
+  def down
+    add_check_constraint :web_push_subscriptions, 'access_token_id IS NOT NULL', name: 'web_push_subscriptions_access_token_id_null', validate: false
+    change_column_null :web_push_subscriptions, :access_token_id, true
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index a1114f2bfc..9c3ecd4d2d 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -1606,8 +1606,8 @@ ActiveRecord::Schema[8.0].define(version: 2025_04_23_224935) do
     t.json "data"
     t.datetime "created_at", precision: nil, null: false
     t.datetime "updated_at", precision: nil, null: false
-    t.bigint "access_token_id"
-    t.bigint "user_id"
+    t.bigint "access_token_id", null: false
+    t.bigint "user_id", null: false
     t.boolean "standard", default: false, null: false
     t.index ["access_token_id"], name: "index_web_push_subscriptions_on_access_token_id", where: "(access_token_id IS NOT NULL)"
     t.index ["user_id"], name: "index_web_push_subscriptions_on_user_id"
diff --git a/spec/fabricators/web_push_subscription_fabricator.rb b/spec/fabricators/web_push_subscription_fabricator.rb
index 6b4028342c..458aa8296e 100644
--- a/spec/fabricators/web_push_subscription_fabricator.rb
+++ b/spec/fabricators/web_push_subscription_fabricator.rb
@@ -8,4 +8,6 @@ Fabricator(:web_push_subscription, from: Web::PushSubscription) do
     Base64.urlsafe_encode64(ecdh_key)
   end
   key_auth { Base64.urlsafe_encode64(Random.new.bytes(16)) }
+  user { Fabricate(:user) }
+  access_token { |attrs| Fabricate.build(:accessible_access_token, resource_owner_id: attrs[:user].id) }
 end
diff --git a/spec/requests/api/v1/push/subscriptions_spec.rb b/spec/requests/api/v1/push/subscriptions_spec.rb
index 69adeb9b6f..359de9d95c 100644
--- a/spec/requests/api/v1/push/subscriptions_spec.rb
+++ b/spec/requests/api/v1/push/subscriptions_spec.rb
@@ -207,7 +207,8 @@ RSpec.describe 'API V1 Push Subscriptions' do
     Fabricate(
       :web_push_subscription,
       endpoint: create_payload[:subscription][:endpoint],
-      access_token_id: token.id
+      access_token: token,
+      user: user
     )
   end
 end
diff --git a/yarn.lock b/yarn.lock
index a4bf941f6b..2e632ff9a0 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -13431,7 +13431,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"pg-connection-string@npm:^2.6.0, pg-connection-string@npm:^2.7.0":
+"pg-connection-string@npm:^2.6.0":
+  version: 2.8.1
+  resolution: "pg-connection-string@npm:2.8.1"
+  checksum: 10c0/87cb519d97a5bdc756f71a6b051eea4d4887e2e102bc694ecda935fe636a037666a0444729b08c7a26c2e9e4b052b2b366af58492ccc49704bacd6876f946ce8
+  languageName: node
+  linkType: hard
+
+"pg-connection-string@npm:^2.7.0":
   version: 2.7.0
   resolution: "pg-connection-string@npm:2.7.0"
   checksum: 10c0/50a1496a1c858f9495d78a2c7a66d93ef3602e718aff2953bb5738f3ea616d7f727f32fc20513c9bed127650cd14c1ddc7b458396f4000e689d4b64c65c5c51e
@@ -13462,9 +13469,9 @@ __metadata:
   linkType: hard
 
 "pg-protocol@npm:*":
-  version: 1.8.0
-  resolution: "pg-protocol@npm:1.8.0"
-  checksum: 10c0/2be784955599d84b564795952cee52cc2b8eab0be43f74fc1061506353801e282c1d52c9e0691a9b72092c1f3fde370e9b181e80fef6bb82a9b8d1618bfa91e6
+  version: 1.9.0
+  resolution: "pg-protocol@npm:1.9.0"
+  checksum: 10c0/c37e61d7fafa97f22eabf12de69863f42fdabb3671df9cc2623bd0ffd6bdedc212e7e8460ad2c721c8a08d8477b4f128a923bf2381905d68a23a532ec7517c77
   languageName: node
   linkType: hard