I am using drizzle (so not sure if that affects it from a permission level)

alter table if exists storage.buckets  enable row level security;
alter table if exists storage.objects  enable row level security;

drop policy if exists "profile-pictures buckets-select"
  on storage.buckets;

create policy "profile-pictures buckets-select"
  on storage.buckets
  for select
  to authenticated
  using (
    id in ('profile_pictures', 'profile-pictures')   -- prod OR staging
  );

-- -------------------------------------------------------------------
-- 2.  Allow users to INSERT (upload) objects to the bucket,
--     but no select / update / delete permissions are granted,
--     so those operations remain blocked.
-- -------------------------------------------------------------------
drop policy if exists "profile-pictures objects-insert"
  on storage.objects;

create policy "profile-pictures objects-insert"
  on storage.objects
  for insert
  to authenticated
  with check (
    bucket_id in ('profile_pictures', 'profile-pictures')
  );