diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index 6ddf347..b9c3eb6 100755
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -36,8 +36,28 @@ BACKUP="backups/pig-$(date +%Y%m%d-%H%M%S).sql.gz"
 sudo docker compose -p pig exec -T db pg_dump -U pig pig | gzip > "$BACKUP"
 echo "    $BACKUP ($(du -h "$BACKUP" | cut -f1))"
 
-echo "==> Building and starting"
-sudo docker compose -p pig up -d --build
+echo "==> Building"
+sudo docker compose -p pig build app
+
+echo "==> Starting the database"
+sudo docker compose -p pig up -d db
+for _ in $(seq 1 60); do
+  if sudo docker compose -p pig exec -T db pg_isready -U pig -d pig > /dev/null; then break; fi
+  sleep 1
+done
+if ! sudo docker compose -p pig exec -T db pg_isready -U pig -d pig > /dev/null; then
+  echo "ERROR: database did not become ready within 60 seconds" >&2
+  exit 1
+fi
+
+echo "==> Migrating before the schema-dependent app starts"
+# A release may query a newly introduced table during startup. Running the
+# migration from a one-off container prevents that app from crash-looping
+# before an `exec`-based migration can reach it.
+sudo docker compose -p pig run --rm --no-deps app npx tsx packages/db/src/migrate.ts
+
+echo "==> Starting the app"
+sudo docker compose -p pig up -d app
 
 echo "==> Waiting for health"
 for _ in $(seq 1 60); do
@@ -45,9 +65,6 @@ for _ in $(seq 1 60); do
   sleep 1
 done
 
-echo "==> Migrating"
-sudo docker compose -p pig exec -T app npx tsx packages/db/src/migrate.ts
-
 echo "==> Verifying"
 if curl -sf http://127.0.0.1:8920/api/health | grep -q '"ok":true'; then
   echo "    health ok"