diff --git a/src/ssb.db.c b/src/ssb.db.c
index 1417459c..21976c91 100644
--- a/src/ssb.db.c
+++ b/src/ssb.db.c
@@ -119,6 +119,31 @@ void tf_ssb_db_init(tf_ssb_t* ssb)
 	_tf_ssb_db_exec(db, "CREATE TRIGGER IF NOT EXISTS messages_ai AFTER INSERT ON messages BEGIN INSERT INTO messages_fts(rowid, content) VALUES (new.rowid, new.content); END");
 	_tf_ssb_db_exec(db, "CREATE TRIGGER IF NOT EXISTS messages_ad AFTER DELETE ON messages BEGIN INSERT INTO messages_fts(messages_fts, rowid, content) VALUES ('delete', old.rowid, old.content); END");
 
+	if (!_tf_ssb_db_has_rows(db, "PRAGMA table_list('messages_refs')"))
+	{
+		_tf_ssb_db_exec(db,
+			"CREATE TABLE IF NOT EXISTS messages_refs ("
+			"  message TEXT, "
+			"  ref TEXT, "
+			"  UNIQUE(message, ref)"
+			")");
+		_tf_ssb_db_exec(db, "CREATE TRIGGER IF NOT EXISTS messages_ai_refs AFTER INSERT ON messages BEGIN "
+			"INSERT INTO messages_refs(message, ref) "
+			"SELECT new.id, j.value FROM json_each(new.content) as j WHERE "
+			"j.value LIKE '&%.sha256' OR "
+			"j.value LIKE '%%%.sha256' OR "
+			"j.value LIKE '@%.ed25519'; END");
+		_tf_ssb_db_exec(db, "CREATE TRIGGER IF NOT EXISTS messages_ad_refs AFTER DELETE ON messages BEGIN DELETE FROM messages WHERE messages.id = old.message; END");
+		printf("Populating messages_refs...\n");
+		_tf_ssb_db_exec(db, "INSERT INTO messages_refs(message, ref) "
+			"SELECT messages.id, j.value FROM messages, json_each(messages.content) as j WHERE "
+			"j.value LIKE '&%.sha256' OR "
+			"j.value LIKE '%%%.sha256' OR "
+			"j.value LIKE '@%.ed25519' "
+			"ON CONFLICT DO NOTHING");
+		printf("Done.\n");
+	}
+
 	bool need_add_sequence_before_author = true;
 	bool need_convert_timestamp_to_real = false;
 
@@ -576,6 +601,7 @@ static int _tf_ssb_sqlite_authorizer(void* user_data, int action_code, const cha
 			strcmp(arg0, "messages") == 0 ||
 			strcmp(arg0, "messages_fts") == 0 ||
 			strcmp(arg0, "messages_fts_idx") == 0 ||
+			strcmp(arg0, "messages_refs") == 0 ||
 			strcmp(arg0, "sqlite_master") == 0 ||
 			false)
 			? SQLITE_OK : SQLITE_DENY;