diff --git a/.env.sample b/.env.sample
index 4a669dd..ca26604 100644
--- a/.env.sample
+++ b/.env.sample
@@ -68,6 +68,12 @@ LOGGING_LEVEL_HANDLERS_CONSOLE=INFO
 LOGGING_LEVEL_LOGGERS_ROOT=INFO
 LOGGING_LEVEL_LOGGERS_APP=INFO
 
+##############################################################################
+# MIGRATIONS
+##############################################################################
+# Set to false to disable automatic migrations on backend startup
+# AUTO_MIGRATIONS=true
+
 ##############################################################################
 # COLLABORA ADMIN PANEL
 ##############################################################################
diff --git a/README.md b/README.md
index 5ee60c6..f457c66 100644
--- a/README.md
+++ b/README.md
@@ -27,11 +27,12 @@ This recipe requires four domains. One domain for drive, and one for minio which
 * `abra app config <app-name>`
      - make sure to set MINIO_DOMAIN, COLLABORA_DOMAIN, ONLY_OFFICE_DOMAIN to the domains you set up for each. 
 * `abra app deploy <app-name>`
-* `abra app cmd <app-name> backend migrate` # creates database tables
 * `abra app restart <app-name> minio-createbuckets` (Note: this will appear to fail, but probably worked! Check `abra app logs <app-name> minio-createbuckets`)
 
 You should then be able to visit the landing page of your app, but not yet to login. To login, you need to deploy and integrate single sign on (described below in the "Configure Authentication" section). 
 
+* Migrations run automatically on backend startup. To trigger manually: `abra app cmd <app-name> backend migrate`
+
 Wopi discovery is supposed to happen automatically, but if collabora/onlyoffice are not connecting, you can try running:
 
 * `abra app cmd <app-name> backend trigger_wopi` # connects only office & collabora (if they stop working, try running this again)
diff --git a/abra.sh b/abra.sh
index 5c0a8e4..aa44a01 100755
--- a/abra.sh
+++ b/abra.sh
@@ -4,6 +4,7 @@ export ABRA_ENTRYPOINT_VERSION=v11
 export NGINX_CONF_VERSION=v6
 export ONLYOFFICE_CONF_VERSION=v2
 export PG_BACKUP_VERSION=v4
+export MIGRATE_VERSION=v1
 
 environment() {
   # this exports all the secrets as environment variables
@@ -11,8 +12,7 @@ environment() {
 }
 
 migrate() {
-  environment
-  python manage.py migrate --noinput
+  /migrate.sh
 }
 
 trigger_wopi() {
diff --git a/compose.yml b/compose.yml
index d184ed7..e249b22 100644
--- a/compose.yml
+++ b/compose.yml
@@ -118,9 +118,11 @@ services:
     user: ${DOCKER_USER:-1000}
     image: lasuite/drive-backend:v0.19.0
     command: [ "gunicorn", "-c", "/usr/local/etc/gunicorn/drive.py", "drive.wsgi:application" ]
-    entrypoint: [ "/abra-entrypoint.sh", "/usr/local/bin/entrypoint" ]
+    entrypoint: >
+      sh -c "if [ \"$$AUTO_MIGRATIONS\" = \"true\" ]; then /migrate.sh; fi && exec /abra-entrypoint.sh /usr/local/bin/entrypoint \"$$@\"" --
     environment:
       <<: [ *common-env, *postgres-env ]
+      AUTO_MIGRATIONS: "${AUTO_MIGRATIONS:-true}"
     networks:
       - backend
     depends_on:
@@ -129,6 +131,9 @@ services:
       - source: abra_entrypoint
         target: /abra-entrypoint.sh
         mode: 0555
+      - source: migrate
+        target: /migrate.sh
+        mode: 0555
     secrets:
       - django_sk
       - django_sp
@@ -405,6 +410,9 @@ configs:
   abra_entrypoint:
     name: ${STACK_NAME}_entrypoint_${ABRA_ENTRYPOINT_VERSION}
     file: abra-entrypoint.sh
+  migrate:
+    name: ${STACK_NAME}_migrate_${MIGRATE_VERSION}
+    file: migrate.sh
   onlyoffice_conf:
     name: ${STACK_NAME}_onlyoffice_conf_${ONLYOFFICE_CONF_VERSION}
     file: onlyoffice-config.json.tmpl
diff --git a/migrate.sh b/migrate.sh
new file mode 100644
index 0000000..52b5435
--- /dev/null
+++ b/migrate.sh
@@ -0,0 +1,26 @@
+#!/bin/sh
+set -e
+
+# Load secrets into environment
+source /abra-entrypoint.sh -e
+
+# Wait for database to be ready (up to 30 seconds)
+i=0
+while ! python manage.py check --database default 2>/dev/null; do
+  i=$((i+1))
+  if [ "$i" -ge 30 ]; then
+    echo "migrate: timed out waiting for database" >&2
+    exit 1
+  fi
+  sleep 1
+done
+
+# Idempotent: skip if no pending migrations
+if python manage.py migrate --check > /dev/null 2>&1; then
+  echo "migrate: no pending migrations, skipping"
+  exit 0
+fi
+
+echo "migrate: applying pending migrations..."
+python manage.py migrate --noinput
+echo "migrate: done"