diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 867a821..d37b71c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -352,7 +352,7 @@ jobs:
 
       - name: Push DB schema & seed
         run: |
-          pnpm db:push
+          pnpm --filter @capakraken/db exec prisma db push --schema ./prisma/schema.prisma --force-reset --accept-data-loss --skip-generate
           pnpm db:seed
 
       - name: Run E2E tests
diff --git a/tooling/docker/app-dev-start.sh b/tooling/docker/app-dev-start.sh
index ce96653..4a4c58f 100644
--- a/tooling/docker/app-dev-start.sh
+++ b/tooling/docker/app-dev-start.sh
@@ -21,7 +21,14 @@ CI=true pnpm install --frozen-lockfile
 # Regenerate Prisma client (needed after bind-mount overlays the image layer)
 pnpm --filter @capakraken/db db:generate
 
-# Run pending migrations so a fresh checkout boots against a current schema
+# Sync full schema to the DB first. The files under prisma/migrations/ are
+# idempotent SUPPLEMENTS (see "IF NOT EXISTS" guards in each migration.sql);
+# they assume the base tables already exist from a prior `db push`. On a
+# fresh DB, migrate deploy alone would fail because the first incremental
+# migration references "users" before it exists.
+pnpm --filter @capakraken/db exec prisma db push --schema ./prisma/schema.prisma --accept-data-loss --skip-generate
+
+# Run pending migrations so a fresh checkout picks up incremental additions
 pnpm --filter @capakraken/db db:migrate:deploy
 
 pnpm check:exports