diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index dae5a74f..034251a2 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -84,6 +84,16 @@ jobs:
             --cache-from epicnext-cms:latest \
             -t epicnext-cms:latest .
 
+      - name: Run migrations
+        run: |
+          # Draai DB-migraties van deze commit op de host (de slimme
+          # runtime-image heeft geen source/tsx, zie docker-compose.yml).
+          # Idempotent: al toegepaste migraties worden overgeslagen.
+          # Gebruikt .env uit de eerdere stap (productie-DB). Vóór het
+          # vervangen van de container, zodat het schema klaarstaat.
+          pnpm install --frozen-lockfile
+          pnpm db:migrate
+
       - name: Deploy container
         shell: bash
         run: |
diff --git a/src/lib/deploy-workflow-contract.test.ts b/src/lib/deploy-workflow-contract.test.ts
index 73cce9b9..59583c6c 100644
--- a/src/lib/deploy-workflow-contract.test.ts
+++ b/src/lib/deploy-workflow-contract.test.ts
@@ -62,6 +62,13 @@ describe("deploy job", () => {
 		expect(deployJob).toContain("docker compose");
 	});
 
+	it("runs database migrations before replacing the container", () => {
+		expect(deployJob).toContain("pnpm db:migrate");
+		expect(deployJob.indexOf("pnpm db:migrate")).toBeLessThan(
+			deployJob.indexOf("docker stop epicnext-cms-app"),
+		);
+	});
+
 	it("runs health check", () => {
 		expect(deployJob).toContain("/api/health");
 		expect(deployJob).toContain('"database":true');