diff --git a/core/src/main/java/google/registry/model/domain/token/AllocationToken.java b/core/src/main/java/google/registry/model/domain/token/AllocationToken.java
index 26d914ee5..d76fbe439 100644
--- a/core/src/main/java/google/registry/model/domain/token/AllocationToken.java
+++ b/core/src/main/java/google/registry/model/domain/token/AllocationToken.java
@@ -45,6 +45,7 @@ import google.registry.model.CreateAutoTimestamp;
 import google.registry.model.UpdateAutoTimestampEntity;
 import google.registry.model.billing.BillingEvent.RenewalPriceBehavior;
 import google.registry.model.common.TimedTransitionProperty;
+import google.registry.model.domain.fee.FeeQueryCommandExtensionItem.CommandName;
 import google.registry.model.reporting.HistoryEntry.HistoryEntryId;
 import google.registry.persistence.VKey;
 import google.registry.persistence.WithVKey;
@@ -213,6 +214,9 @@ public class AllocationToken extends UpdateAutoTimestampEntity implements Builda
   TimedTransitionProperty<TokenStatus> tokenStatusTransitions =
       TimedTransitionProperty.withInitialValue(NOT_STARTED);
 
+  /** Allowed EPP actions for this token, or null if all actions are allowed. */
+  @Nullable Set<CommandName> allowedEppActions;
+
   public String getToken() {
     return token;
   }
@@ -263,6 +267,10 @@ public class AllocationToken extends UpdateAutoTimestampEntity implements Builda
     return tokenStatusTransitions;
   }
 
+  public ImmutableSet<CommandName> getAllowedEppActions() {
+    return nullToEmptyImmutableCopy(allowedEppActions);
+  }
+
   public RenewalPriceBehavior getRenewalPriceBehavior() {
     return renewalPriceBehavior;
   }
@@ -450,6 +458,11 @@ public class AllocationToken extends UpdateAutoTimestampEntity implements Builda
       return this;
     }
 
+    public Builder setAllowedEppActions(Set<CommandName> allowedEppActions) {
+      getInstance().allowedEppActions = forceEmptyToNull(allowedEppActions);
+      return this;
+    }
+
     public Builder setRenewalPriceBehavior(RenewalPriceBehavior renewalPriceBehavior) {
       getInstance().renewalPriceBehavior = renewalPriceBehavior;
       return this;
diff --git a/core/src/main/java/google/registry/persistence/converter/CommandNameSetConverter.java b/core/src/main/java/google/registry/persistence/converter/CommandNameSetConverter.java
new file mode 100644
index 000000000..babed838f
--- /dev/null
+++ b/core/src/main/java/google/registry/persistence/converter/CommandNameSetConverter.java
@@ -0,0 +1,34 @@
+// Copyright 2023 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.persistence.converter;
+
+import google.registry.model.domain.fee.FeeQueryCommandExtensionItem;
+import google.registry.model.domain.fee.FeeQueryCommandExtensionItem.CommandName;
+import javax.persistence.Converter;
+
+@Converter(autoApply = true)
+public class CommandNameSetConverter
+    extends StringSetConverterBase<FeeQueryCommandExtensionItem.CommandName> {
+
+  @Override
+  String toString(CommandName element) {
+    return element.name();
+  }
+
+  @Override
+  CommandName fromString(String value) {
+    return FeeQueryCommandExtensionItem.CommandName.valueOf(value);
+  }
+}
diff --git a/core/src/main/resources/META-INF/persistence.xml b/core/src/main/resources/META-INF/persistence.xml
index cf5b0055a..2b2d1033d 100644
--- a/core/src/main/resources/META-INF/persistence.xml
+++ b/core/src/main/resources/META-INF/persistence.xml
@@ -85,6 +85,7 @@
     <class>google.registry.persistence.converter.BillingEventFlagSetConverter</class>
     <class>google.registry.persistence.converter.BloomFilterConverter</class>
     <class>google.registry.persistence.converter.CidrAddressBlockListConverter</class>
+    <class>google.registry.persistence.converter.CommandNameSetConverter</class>
     <class>google.registry.persistence.converter.CurrencyToBillingConverter</class>
     <class>google.registry.persistence.converter.CurrencyUnitConverter</class>
     <class>google.registry.persistence.converter.DatabaseMigrationScheduleTransitionConverter</class>
diff --git a/core/src/test/java/google/registry/model/domain/token/AllocationTokenTest.java b/core/src/test/java/google/registry/model/domain/token/AllocationTokenTest.java
index 6563091a5..fa3489045 100644
--- a/core/src/test/java/google/registry/model/domain/token/AllocationTokenTest.java
+++ b/core/src/test/java/google/registry/model/domain/token/AllocationTokenTest.java
@@ -37,6 +37,7 @@ import google.registry.model.Buildable;
 import google.registry.model.EntityTestCase;
 import google.registry.model.billing.BillingEvent.RenewalPriceBehavior;
 import google.registry.model.domain.Domain;
+import google.registry.model.domain.fee.FeeQueryCommandExtensionItem.CommandName;
 import google.registry.model.domain.token.AllocationToken.RegistrationBehavior;
 import google.registry.model.domain.token.AllocationToken.TokenStatus;
 import google.registry.model.domain.token.AllocationToken.TokenType;
@@ -77,6 +78,7 @@ public class AllocationTokenTest extends EntityTestCase {
                         .put(DateTime.now(UTC), TokenStatus.VALID)
                         .put(DateTime.now(UTC).plusWeeks(8), TokenStatus.ENDED)
                         .build())
+                .setAllowedEppActions(ImmutableSet.of(CommandName.CREATE, CommandName.RENEW))
                 .build());
     assertThat(loadByEntity(unlimitedUseToken)).isEqualTo(unlimitedUseToken);
 
@@ -113,6 +115,7 @@ public class AllocationTokenTest extends EntityTestCase {
                         .put(DateTime.now(UTC), TokenStatus.VALID)
                         .put(DateTime.now(UTC).plusWeeks(8), TokenStatus.ENDED)
                         .build())
+                .setAllowedEppActions(ImmutableSet.of(CommandName.CREATE, CommandName.RENEW))
                 .build());
     AllocationToken persisted = loadByEntity(unlimitedUseToken);
     assertThat(SerializeUtils.serializeDeserialize(persisted)).isEqualTo(persisted);
diff --git a/db/src/main/resources/sql/schema/db-schema.sql.generated b/db/src/main/resources/sql/schema/db-schema.sql.generated
index 1ffc5b4e8..ba5924537 100644
--- a/db/src/main/resources/sql/schema/db-schema.sql.generated
+++ b/db/src/main/resources/sql/schema/db-schema.sql.generated
@@ -16,6 +16,7 @@
        token text not null,
         update_timestamp timestamptz,
         allowed_registrar_ids text[],
+        allowed_epp_actions text[],
         allowed_tlds text[],
         creation_time timestamptz not null,
         discount_fraction float8 not null,