diff --git a/argocd/manifests/paperless-ringtail/deployment.yaml b/argocd/manifests/paperless-ringtail/deployment.yaml
index 92977ce..1f283c9 100644
--- a/argocd/manifests/paperless-ringtail/deployment.yaml
+++ b/argocd/manifests/paperless-ringtail/deployment.yaml
@@ -1,13 +1,15 @@
 # Paperless-ngx on ringtail k3s — Nix image, multi-process.
 #
-# The upstream s6 image ran web + worker + scheduler + consumer in one
-# container. The Nix image (containers/paperless/default.nix) ships the
-# binaries but no supervisor, so we run those as four containers in one
-# pod, sharing the local data/consume dirs (emptyDir) and the NFS media
-# volume; redis is colocated so PAPERLESS_REDIS=localhost works for all.
+# The upstream s6 image ran web + worker + scheduler + consumer (and DB
+# migrations) in one container. The Nix image (containers/paperless/
+# default.nix) ships the binaries but no supervisor, so we run those as
+# four containers in one pod, sharing the local data/consume dirs
+# (emptyDir) and the NFS media volume; redis is colocated so
+# PAPERLESS_REDIS=localhost works for all. A migrate initContainer runs
+# DB migrations once before the app containers start.
 #
-# DB now points in-cluster at the ringtail blumeops-pg (was pg.ops.eblu.me
-# on indri). PAPERLESS_{DATA_DIR,MEDIA_ROOT,CONSUMPTION_DIR} are set
+# DB points in-cluster at the ringtail blumeops-pg (was pg.ops.eblu.me on
+# indri). PAPERLESS_{DATA_DIR,MEDIA_ROOT,CONSUMPTION_DIR} are set
 # explicitly because the Nix package does not default to the upstream
 # /usr/src/paperless paths.
 apiVersion: apps/v1
@@ -30,12 +32,10 @@ spec:
       securityContext:
         seccompProfile:
           type: RuntimeDefault
-      containers:
-        - name: web
+      initContainers:
+        - name: migrate
           image: registry.ops.eblu.me/blumeops/paperless:kustomized
-          ports:
-            - containerPort: 8000
-              name: http
+          command: ["paperless-ngx", "migrate", "--no-input"]
           env: &paperless-env
             - name: PAPERLESS_URL
               value: "https://paperless.ops.eblu.me"
@@ -106,6 +106,14 @@ spec:
               mountPath: /usr/src/paperless/media
             - name: consume
               mountPath: /usr/src/paperless/consume
+      containers:
+        - name: web
+          image: registry.ops.eblu.me/blumeops/paperless:kustomized
+          ports:
+            - containerPort: 8000
+              name: http
+          env: *paperless-env
+          volumeMounts: *paperless-mounts
           resources:
             requests:
               memory: "256Mi"