diff --git a/apps/edr-passenger-api/Dockerfile b/apps/edr-passenger-api/Dockerfile
index 5fd647968..2b0ee8041 100644
--- a/apps/edr-passenger-api/Dockerfile
+++ b/apps/edr-passenger-api/Dockerfile
@@ -1,29 +1,25 @@
 # syntax=docker/dockerfile:1
 # Build from monorepo root: docker build -f apps/edr-passenger-api/Dockerfile .
-# On start: runs prisma migrate deploy + seed, then the API.
-
+# On start: runs the API only — migrations/seed now run separately via the
+# `migration` stage, invoked as a one-shot container in CI before deploy.
 FROM node:24.15.0-alpine AS base
 RUN apk add --no-cache libc6-compat
 RUN corepack enable
 WORKDIR /app
-
 FROM base AS pruner
 COPY . .
 RUN pnpm dlx turbo prune "@edr/passenger-api" --docker
-
 FROM base AS installer
 COPY --from=pruner /app/out/json/ .
 COPY --from=pruner /app/out/pnpm-lock.yaml ./pnpm-lock.yaml
 RUN --mount=type=secret,id=npmrc,target=./.npmrc,required=false \
     --mount=type=cache,id=pnpm,target=/pnpm/store \
     pnpm install --frozen-lockfile
-
 FROM base AS builder
 COPY --from=installer /app/ .
 COPY --from=pruner /app/out/full/ .
 RUN pnpm --filter "@edr/passenger-api" exec prisma generate
 RUN pnpm turbo build --filter="@edr/passenger-api..."
-
 FROM base AS deployer
 COPY --from=builder /app/ .
 RUN pnpm deploy --filter="@edr/passenger-api" --legacy /deploy
@@ -32,20 +28,24 @@ RUN if [ -d node_modules/.prisma ]; then \
       cp -r node_modules/.prisma /deploy/node_modules/.prisma; \
     fi
 
+# --- Migration image: built in CI, run as a one-shot `docker run --rm --env-file ...`
+# against the real DB, as its own gated step *before* the app image is built/deployed.
+# Runs the same generate + migrate + seed sequence the old entrypoint used to run at
+# container start, but now as a throwaway container, before the app container exists.
+FROM deployer AS migration
+WORKDIR /deploy
+RUN corepack enable && corepack prepare pnpm@11.1.1 --activate
+ENV CI=true
+ENV COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+CMD ["sh", "-c", "npm run prisma:generate && npm run prisma:migrate && npm run prisma:seed"]
+
 FROM node:24.15.0-alpine AS runner
 RUN apk add --no-cache libc6-compat
-RUN corepack enable && corepack prepare pnpm@11.1.1 --activate
 ENV NODE_ENV=production
 WORKDIR /app
 RUN addgroup --system --gid 1001 nodejs \
     && adduser --system --uid 1001 --ingroup nodejs nestjs
-COPY --from=deployer /deploy .
-COPY apps/edr-passenger-api/docker-entrypoint.sh /docker-entrypoint.sh
-RUN chmod +x /docker-entrypoint.sh \
-    && chown -R nestjs:nodejs /app
+COPY --from=deployer --chown=nestjs:nodejs /deploy .
 USER nestjs
-ENV CI=true
-ENV COREPACK_ENABLE_DOWNLOAD_PROMPT=0
 EXPOSE 4000
-ENTRYPOINT ["/docker-entrypoint.sh"]
 CMD ["node", "dist/main.js"]