diff --git a/packages/contracts-da-bridge/.env.example b/packages/contracts-da-bridge/.env.example
index e552075e..3ef0ad2e 100644
--- a/packages/contracts-da-bridge/.env.example
+++ b/packages/contracts-da-bridge/.env.example
@@ -5,5 +5,6 @@ PRIVATE_KEY=
 GOERLI_DOMAIN= 
 AVAIL_DOMAIN=
 AVAIL_UPDATER_ADDRESS=
+DA_BRIDGE_WATCHER_ADDRESS=
 OPTIMISTIC_SECONDS=
 DA_BRIDGE_PALLET_ID=
\ No newline at end of file
diff --git a/packages/contracts-da-bridge/contracts/script/DeployDemo.s.sol b/packages/contracts-da-bridge/contracts/script/DeployDemo.s.sol
index 6bfadd0c..2e64fdba 100644
--- a/packages/contracts-da-bridge/contracts/script/DeployDemo.s.sol
+++ b/packages/contracts-da-bridge/contracts/script/DeployDemo.s.sol
@@ -11,6 +11,7 @@ contract DeployDABridgeRouter is Script {
     uint256 localDomain;
     uint256 remoteDomain;
     address remoteUpdater;
+    address daBridgeWatcher;
     uint256 optimisticSeconds;
     bytes32 daBridgePalletId;
 
@@ -18,6 +19,7 @@ contract DeployDABridgeRouter is Script {
         localDomain = vm.envUint("GOERLI_DOMAIN");
         remoteDomain = vm.envUint("AVAIL_DOMAIN");
         remoteUpdater = vm.envAddress("AVAIL_UPDATER_ADDRESS");
+        daBridgeWatcher = vm.envAddress("DA_BRIDGE_WATCHER_ADDRESS");
         optimisticSeconds = vm.envUint("OPTIMISTIC_SECONDS");
         daBridgePalletId = vm.envBytes32("DA_BRIDGE_PALLET_ID");
     }
@@ -38,11 +40,22 @@ contract DeployDABridgeRouter is Script {
         );
 
         XAppConnectionManager manager = new XAppConnectionManager();
+
+        // Entity to with permission to set home, enroll replica, and set
+        // watcher permissions is contract owner (deployer by default).
         manager.setHome(address(home));
         manager.ownerEnrollReplica(address(replica), uint32(remoteDomain));
+        manager.setWatcherPermission(
+            daBridgeWatcher,
+            uint32(remoteDomain),
+            true
+        );
 
         DABridgeRouter router = new DABridgeRouter();
         router.initialize(address(manager), uint32(remoteDomain));
+
+        // Entity to with permission to enroll remote router is contract owner
+        // (deployer by default).
         router.enrollRemoteRouter(uint32(remoteDomain), daBridgePalletId);
 
         vm.stopBroadcast();