diff --git a/apps/server/docker-entrypoint.sh b/apps/server/docker-entrypoint.sh
index 508c7fa..482d429 100644
--- a/apps/server/docker-entrypoint.sh
+++ b/apps/server/docker-entrypoint.sh
@@ -1,5 +1,9 @@
 #!/bin/sh
 set -e
-# Sync DB schema (creates tables if none exist; use migrate deploy once you have migration files)
-npx prisma db push --schema=prisma/schema.prisma
+# Apply pending migrations (idempotent — a no-op when the DB is already up to date).
+# Replaces the old `prisma db push`, which could not run data-preserving migrations (e.g. adding a
+# NOT NULL column to a populated table). Pre-existing databases were baselined for the initial
+# schema + hash-refresh-tokens migrations via `prisma migrate resolve --applied`, so only new
+# migrations run here.
+npx prisma migrate deploy --schema=prisma/schema.prisma
 exec node dist/main.js