diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fe3f2e3..3122304 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -351,20 +351,21 @@ jobs:
         run: pnpm --filter @capakraken/web exec playwright install-deps chromium
 
       - name: Push DB schema & seed
-        env:
-          PGPASSWORD: capakraken_test
         run: |
           # Nuke any leftover schema state from a previous job that shared the
           # postgres service container (act_runner reuses service volumes).
-          # --force-reset alone proved unreliable here: push reported "in sync"
-          # but audit_logs ended up missing, suggesting a split-brain between
-          # the reset and the subsequent DDL.
-          psql -h postgres -U capakraken -d capakraken_test -v ON_ERROR_STOP=1 \
-            -c "DROP SCHEMA IF EXISTS public CASCADE; CREATE SCHEMA public; GRANT ALL ON SCHEMA public TO capakraken; GRANT ALL ON SCHEMA public TO public;"
+          # --force-reset alone proved unreliable: push reported "in sync" but
+          # audit_logs ended up missing. Use prisma db execute (no psql dep).
+          printf '%s\n' \
+            'DROP SCHEMA IF EXISTS public CASCADE;' \
+            'CREATE SCHEMA public;' \
+            'GRANT ALL ON SCHEMA public TO capakraken;' \
+            'GRANT ALL ON SCHEMA public TO public;' \
+            | pnpm --filter @capakraken/db exec prisma db execute --stdin --schema ./prisma/schema.prisma
           pnpm --filter @capakraken/db exec prisma db push --schema ./prisma/schema.prisma --accept-data-loss --skip-generate
           # Sanity check: confirm the schema actually landed before seeding.
-          psql -h postgres -U capakraken -d capakraken_test -v ON_ERROR_STOP=1 \
-            -c "SELECT to_regclass('public.audit_logs') AS audit_logs, to_regclass('public.users') AS users;"
+          printf "SELECT to_regclass('public.audit_logs'), to_regclass('public.users');\n" \
+            | pnpm --filter @capakraken/db exec prisma db execute --stdin --schema ./prisma/schema.prisma
           pnpm db:seed
 
       - name: Run E2E tests
diff --git a/tooling/docker/app-dev-start.sh b/tooling/docker/app-dev-start.sh
index 4a4c58f..1f67c5b 100644
--- a/tooling/docker/app-dev-start.sh
+++ b/tooling/docker/app-dev-start.sh
@@ -28,6 +28,17 @@ pnpm --filter @capakraken/db db:generate
 # migration references "users" before it exists.
 pnpm --filter @capakraken/db exec prisma db push --schema ./prisma/schema.prisma --accept-data-loss --skip-generate
 
+# After db push the schema matches schema.prisma exactly, but the
+# _prisma_migrations table is empty, which makes `migrate deploy` fail
+# with P3005 ("schema is not empty"). Baseline each migration as applied
+# so deploy sees a clean slate; the migrations themselves are idempotent
+# supplements (IF NOT EXISTS guards), so marking-as-applied is safe.
+for m in packages/db/prisma/migrations/*/; do
+  name=$(basename "$m")
+  pnpm --filter @capakraken/db exec prisma migrate resolve \
+    --applied "$name" --schema ./prisma/schema.prisma || true
+done
+
 # Run pending migrations so a fresh checkout picks up incremental additions
 pnpm --filter @capakraken/db db:migrate:deploy