diff --git a/.github/act-event.json b/.github/act-event.json
new file mode 100644
index 0000000..c6b9397
--- /dev/null
+++ b/.github/act-event.json
@@ -0,0 +1,6 @@
+{
+  "action": "created",
+  "release": {
+    "tag_name": "v0.0.0-test"
+  }
+}
diff --git a/.github/workflows/build-and-publish.yaml b/.github/workflows/build-and-publish.yaml
index 8c8ea4b..9cb5421 100644
--- a/.github/workflows/build-and-publish.yaml
+++ b/.github/workflows/build-and-publish.yaml
@@ -26,12 +26,50 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           push: true
+          target: runtime
           tags: |
             ghcr.io/project-optima/ttscm-api:latest
             ghcr.io/project-optima/ttscm-api:${{ github.event.release.tag_name }}
+
+      - name: Build and push the migration image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          target: migration
+          tags: |
+            ghcr.io/project-optima/ttscm-api-migrate:latest
+            ghcr.io/project-optima/ttscm-api-migrate:${{ github.event.release.tag_name }}
+
+  migrate:
+    name: Run Migrations
+    needs: [build]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set the Kubernetes context
+        uses: azure/k8s-set-context@v2
+        with:
+          method: kubeconfig
+          kubeconfig: ${{ secrets.KUBECONFIG }}
+
+      - name: Checkout source code
+        uses: actions/checkout@v4
+
+      - name: Delete previous migration job if exists
+        run: kubectl delete job -n optima -l app=prisma-migrate --ignore-not-found
+
+      - name: Apply migration job
+        run: |
+          TAG=${{ github.event.release.tag_name }}
+          sed "s/RELEASE_TAG/${TAG}/g" kubernetes/migration-job.yaml | kubectl apply -f -
+
+      - name: Wait for migration to complete
+        run: |
+          TAG=${{ github.event.release.tag_name }}
+          kubectl wait --for=condition=complete --timeout=120s -n optima job/prisma-migrate-${TAG}
+
   deploy:
     name: Deploy
-    needs: [build]
+    needs: [migrate]
     runs-on: ubuntu-latest
     steps:
       - name: Set the Kubernetes context
diff --git a/Dockerfile b/Dockerfile
index 4bcd022..912435a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -54,4 +54,17 @@ COPY --from=deps /app/node_modules/ ./node_modules/
 ENV NODE_ENV=production
 EXPOSE 3000
 
-CMD ["./server"] 
\ No newline at end of file
+CMD ["./server"]
+
+# ---- Stage 4: Migration runner ----
+FROM oven/bun:1 AS migration
+
+WORKDIR /app
+
+COPY package.json bun.lock ./
+RUN bun install --frozen-lockfile
+
+COPY prisma/ prisma/
+COPY prisma.config.ts ./
+
+CMD ["bunx", "prisma", "migrate", "deploy"]
\ No newline at end of file
diff --git a/kubernetes/migration-job.yaml b/kubernetes/migration-job.yaml
new file mode 100644
index 0000000..832069e
--- /dev/null
+++ b/kubernetes/migration-job.yaml
@@ -0,0 +1,21 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: prisma-migrate-RELEASE_TAG
+  namespace: optima
+  labels:
+    app: prisma-migrate
+spec:
+  backoffLimit: 3
+  ttlSecondsAfterFinished: 300
+  template:
+    spec:
+      containers:
+        - name: migrate
+          image: ghcr.io/project-optima/ttscm-api-migrate:RELEASE_TAG
+          envFrom:
+            - secretRef:
+                name: optima-api-env
+      restartPolicy: Never
+      imagePullSecrets:
+        - name: github-container-registry
diff --git a/package.json b/package.json
index 3d1fc93..f0f017b 100644
--- a/package.json
+++ b/package.json
@@ -21,6 +21,7 @@
     "dev": "NODE_ENV=development bun --watch src/index.ts",
     "db:gen": "prisma generate",
     "db:push": "prisma migrate dev --skip-generate",
+    "db:deploy": "prisma migrate deploy",
     "utils:dev": "docker compose -f .docker/docker-compose.yml up --build",
     "utils:gen_private_keys": "bun ./utils/genPrivateKeys",
     "utils:create_admin_role": "bun ./utils/createAdminRole",