diff --git a/apps/edr-payment-api/Dockerfile b/apps/edr-payment-api/Dockerfile
index ea35c1f39..5cddf5232 100644
--- a/apps/edr-payment-api/Dockerfile
+++ b/apps/edr-payment-api/Dockerfile
@@ -1,30 +1,32 @@
 # syntax=docker/dockerfile:1
-# Build from monorepo root: docker build -f apps/edr-freight-api/Dockerfile .
-
+# Build from monorepo root: docker build -f apps/edr-payment-api/Dockerfile .
 FROM node:24.15.0-alpine AS base
 RUN apk add --no-cache libc6-compat
 RUN corepack enable
 WORKDIR /app
-
 FROM base AS pruner
 COPY . .
 RUN pnpm dlx turbo prune "@edr/payment-api" --docker
-
 FROM base AS installer
 COPY --from=pruner /app/out/json/ .
 COPY --from=pruner /app/out/pnpm-lock.yaml ./pnpm-lock.yaml
 RUN --mount=type=secret,id=npmrc,target=./.npmrc,required=false \
     pnpm install --frozen-lockfile
-
 FROM base AS builder
 COPY --from=installer /app/ .
 COPY --from=pruner /app/out/full/ .
 RUN pnpm turbo build --filter="@edr/payment-api..."
-
 FROM base AS deployer
 COPY --from=builder /app/ .
 RUN pnpm deploy --filter="@edr/payment-api" --prod --legacy --ignore-scripts /deploy
 
+# --- Migration image: built in CI, run as a one-shot `docker run --rm --env-file ...`
+# against the real DB, as its own gated step *before* the app image is built/deployed.
+# The runner below only ever runs `node dist/main.js` — migrations happen here, not there.
+FROM deployer AS migration
+WORKDIR /deploy
+CMD ["node", "dist/scripts/migrate.js"]
+
 FROM node:24.15.0-alpine AS runner
 RUN apk add --no-cache libc6-compat
 ENV NODE_ENV=production
@@ -32,10 +34,6 @@ WORKDIR /app
 RUN addgroup --system --gid 1001 nodejs \
     && adduser --system --uid 1001 --ingroup nodejs nestjs
 COPY --from=deployer --chown=nestjs:nodejs /deploy .
-COPY apps/edr-payment-api/docker-entrypoint.sh /docker-entrypoint.sh
-RUN chmod +x /docker-entrypoint.sh \
-    && chown -R nestjs:nodejs /app
 USER nestjs
 EXPOSE 3008
-ENTRYPOINT ["/docker-entrypoint.sh"]
 CMD ["node", "dist/main.js"]