diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index dce84af..ab1bdc4 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -30,7 +30,7 @@ jobs:
 
               docker compose build
               docker compose up -d
-              docker compose exec app bunx drizzle-kit push --force
+              docker compose exec app drizzle-kit push --force
             else
               cd /opt/esports-staging
               git fetch origin staging
@@ -39,5 +39,5 @@ jobs:
 
               docker compose -f docker-compose.staging.yml --env-file .env.staging -p esports-staging build
               docker compose -f docker-compose.staging.yml --env-file .env.staging -p esports-staging up -d
-              docker compose -f docker-compose.staging.yml --env-file .env.staging -p esports-staging exec staging-app bunx drizzle-kit push --force
+              docker compose -f docker-compose.staging.yml --env-file .env.staging -p esports-staging exec staging-app drizzle-kit push --force
             fi
diff --git a/Dockerfile b/Dockerfile
index 70e3f0e..c889801 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -14,10 +14,10 @@ ENV NODE_ENV=production
 ENV BETTER_AUTH_SECRET=build-placeholder
 RUN --mount=type=cache,target=/app/.svelte-kit bun run build
 
-# Runtime — prod deps only
+# Runtime — prod deps + drizzle-kit for migrations
 FROM base AS runtime
 COPY package.json bun.lock ./
-RUN bun install --frozen-lockfile --production
+RUN bun install --frozen-lockfile --production && bun add drizzle-kit drizzle-orm
 COPY --from=build /app/build build
 COPY drizzle.config.ts ./
 COPY src/lib/server/db/schema.ts src/lib/server/db/auth.schema.ts src/lib/server/db/