diff --git a/internal/proto/local/controller/storage/oplog/store/v1/oplog.proto b/internal/proto/local/controller/storage/oplog/store/v1/oplog.proto
index 1001e0088a..ab890cc8ae 100644
--- a/internal/proto/local/controller/storage/oplog/store/v1/oplog.proto
+++ b/internal/proto/local/controller/storage/oplog/store/v1/oplog.proto
@@ -19,9 +19,9 @@ message Timestamp {
 message Entry {
   // @inject_tag: gorm:"primary_key"
   uint32 id = 1;
-  // @inject_tag: gorm:"not_null;type:TIMESTAMP"
+  // @inject_tag: `gorm:"default:current_timestamp"`
   Timestamp create_time = 2;
-  // @inject_tag: gorm:"not_null;type:TIMESTAMP"
+  // @inject_tag: `gorm:"default:current_timestamp"`
   Timestamp update_time = 3;
 
   // @inject_tag: gorm:"not_null"
@@ -34,15 +34,21 @@ message Entry {
   // @inject_tag: gorm:"foreignkey:entry_id"
   repeated Metadata metadata = 6;
 
-  // @inject_tat: gorm:"not_null"
-  bytes data = 7;
+  // ciphertext entry data stored in the database
+  // @inject_tag: gorm:"column:data;not_null" wrapping:"ct,entry_data"
+  bytes ct_data = 7;
+
+  // plain text version of the decrypted entry data
+  // we are NOT storing this plain-text entry data in the db
+  // @inject_tag: gorm:"-" wrapping:"pt,entry_data"
+  bytes data = 8;
 }
 
 // Metadata provides a message for oplog metadata that's compatible with gorm
 message Metadata {
   // @inject_tag: gorm:"primary_key"
   uint32 id = 1;
-  // @inject_tag: gorm:"not_null;type:TIMESTAMP"
+  // @inject_tag: `gorm:"default:current_timestamp"`
   Timestamp create_time = 2;
   // @inject_tag: gorm:"not_nul
 
@@ -60,9 +66,9 @@ message Metadata {
 message Ticket {
   // @inject_tag: gorm:"primary_key"
   uint32 id = 1;
-  // @inject_tag: gorm:"not_null;type:TIMESTAMP"
+  // @inject_tag: `gorm:"default:current_timestamp"`
   Timestamp create_time = 2;
-  // @inject_tag: gorm:"not_null;type:TIMESTAMP"
+  // @inject_tag: `gorm:"default:current_timestamp"`
   Timestamp update_time = 3;
 
   // @inject_tat: gorm:"not_null"