diff --git a/migrations/2022-11-23-135139_add-token-scopes/down.sql b/migrations/2022-11-23-135139_add-token-scopes/down.sql
new file mode 100644
index 00000000000..2ff19831772
--- /dev/null
+++ b/migrations/2022-11-23-135139_add-token-scopes/down.sql
@@ -0,0 +1,5 @@
+alter table api_tokens
+    drop column crate_scopes;
+
+alter table api_tokens
+    drop column endpoint_scopes;
diff --git a/migrations/2022-11-23-135139_add-token-scopes/up.sql b/migrations/2022-11-23-135139_add-token-scopes/up.sql
new file mode 100644
index 00000000000..39c04f641bb
--- /dev/null
+++ b/migrations/2022-11-23-135139_add-token-scopes/up.sql
@@ -0,0 +1,9 @@
+alter table api_tokens
+    add column crate_scopes text[];
+
+comment on column api_tokens.crate_scopes is 'NULL or an array of crate scope patterns (see RFC #2947)';
+
+alter table api_tokens
+    add column endpoint_scopes text[];
+
+comment on column api_tokens.endpoint_scopes is 'An array of endpoint scopes or NULL for the `legacy` endpoint scope (see RFC #2947)';
diff --git a/src/models/token.rs b/src/models/token.rs
index 074fe4acc54..15d71126299 100644
--- a/src/models/token.rs
+++ b/src/models/token.rs
@@ -23,6 +23,12 @@ pub struct ApiToken {
     pub last_used_at: Option<NaiveDateTime>,
     #[serde(skip)]
     pub revoked: bool,
+    /// `None` or a list of crate scope patterns (see RFC #2947)
+    #[serde(skip)]
+    pub crate_scopes: Option<Vec<String>>,
+    /// A list of endpoint scopes or `None` for the `legacy` endpoint scope (see RFC #2947)
+    #[serde(skip)]
+    pub endpoint_scopes: Option<Vec<String>>,
 }
 
 impl ApiToken {
@@ -106,6 +112,8 @@ mod tests {
                     .and_hms_opt(14, 23, 12),
             )
             .unwrap(),
+            crate_scopes: None,
+            endpoint_scopes: None,
         };
         let json = serde_json::to_string(&tok).unwrap();
         assert_some!(json
diff --git a/src/schema.rs b/src/schema.rs
index b4494c6c515..f2a8546aa7d 100644
--- a/src/schema.rs
+++ b/src/schema.rs
@@ -50,6 +50,18 @@ table! {
         ///
         /// (Automatically generated by Diesel.)
         revoked -> Bool,
+        /// The `crate_scopes` column of the `api_tokens` table.
+        ///
+        /// Its SQL type is `Nullable<Array<Text>>`.
+        ///
+        /// (Automatically generated by Diesel.)
+        crate_scopes -> Nullable<Array<Text>>,
+        /// The `endpoint_scopes` column of the `api_tokens` table.
+        ///
+        /// Its SQL type is `Nullable<Array<Text>>`.
+        ///
+        /// (Automatically generated by Diesel.)
+        endpoint_scopes -> Nullable<Array<Text>>,
     }
 }
 
diff --git a/src/worker/dump_db/dump-db.toml b/src/worker/dump_db/dump-db.toml
index 8a1575135da..6c66c80b526 100644
--- a/src/worker/dump_db/dump-db.toml
+++ b/src/worker/dump_db/dump-db.toml
@@ -26,6 +26,8 @@ name = "private"
 created_at = "private"
 last_used_at = "private"
 revoked = "private"
+crate_scopes = "private"
+endpoint_scopes = "private"
 
 [background_jobs.columns]
 id = "private"