diff --git a/.env.example b/.env.example
index 8a807c8..9326804 100644
--- a/.env.example
+++ b/.env.example
@@ -20,10 +20,11 @@ DASHBOARD_ORIGIN=https://vigilcare-records.vectur45.com
 # Runtime (DML-only) connection used by the API container.
 PG_CONNECTION="Host=postgres;Port=5432;Database=vigilcare_records;Username=vigilcare_records_app;Password=CHANGE_ME;SSL Mode=Disable"
 # DDL-privileged connection used ONLY by the EF migration bundle (CD migrate job).
-# That job runs on the act_runner host directly (not joined to shared-services), so
-# it needs the externally-routable host:port, not the container network name.
+# CD copies migrate-api to the deploy host and runs it in a one-shot container on
+# shared-services, so use the same Docker DNS name as PG_CONNECTION (Host=postgres),
+# not an external hostname. Store this as Gitea secret PG_CONNECTION_DDL.
 # Never put this credential in the API container environment.
-PG_CONNECTION_DDL="Host=postgres.site.com;Port=5432;Database=vigilcare_records;Username=vigilcare_records_migrator;Password=CHANGE_ME;SSL Mode=Require;Trust Server Certificate=false"
+PG_CONNECTION_DDL="Host=postgres;Port=5432;Database=vigilcare_records;Username=vigilcare_records_migrator;Password=CHANGE_ME;SSL Mode=Disable"
 
 # ---- Redis (shared-services network) ----
 # "redis" = the service name on the shared Redis compose project.
diff --git a/.gitea/workflows/cd.yml b/.gitea/workflows/cd.yml
index e112f6a..bda1a89 100644
--- a/.gitea/workflows/cd.yml
+++ b/.gitea/workflows/cd.yml
@@ -70,6 +70,9 @@ jobs:
     # Checkout must run on the job host. Build the EF bundle via Dockerfile
     # --target migrate (context upload), not docker run -v — under act_runner
     # bind mounts resolve on the Docker host, not the job workspace.
+    # Postgres lives on the deploy host's shared-services network and is not
+    # reachable from act_runner, so the bundle is copied there and executed in
+    # a one-shot container joined to that network (Host=postgres resolves).
     # NOTE: Program.cs also runs db.Database.MigrateAsync() on API startup, so
     # this job is a defense-in-depth pre-deploy step using a DDL-privileged
     # credential the API container never sees, not the only migration path.
@@ -85,12 +88,34 @@ jobs:
           docker rm "$cid"
           chmod +x ./migrate-api
 
+      - name: Configure SSH
+        run: |
+          mkdir -p ~/.ssh
+          echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          ssh-keyscan -H "${{ secrets.DEPLOY_HOST }}" >> ~/.ssh/known_hosts
+
       # Runs while the previous release is still serving traffic, so every
       # migration must be backwards-compatible with the outgoing image
-      # (expand-then-contract). Self-contained linux-x64 binary — runs on the
-      # job host directly.
+      # (expand-then-contract).
       - name: Apply migrations
-        run: ./migrate-api --connection "${{ secrets.PG_CONNECTION_DDL }}"
+        env:
+          PG_CONNECTION_DDL: ${{ secrets.PG_CONNECTION_DDL }}
+        run: |
+          scp -i ~/.ssh/id_ed25519 ./migrate-api \
+            "${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}:/tmp/vigilcare-records-migrate-api"
+          ssh -i ~/.ssh/id_ed25519 \
+            "${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}" \
+            PG_CONNECTION_DDL="$PG_CONNECTION_DDL" bash -euo pipefail <<'EOF'
+            chmod +x /tmp/vigilcare-records-migrate-api
+            docker run --rm \
+              --network shared-services \
+              -v /tmp/vigilcare-records-migrate-api:/migrate-api:ro \
+              --entrypoint /migrate-api \
+              mcr.microsoft.com/dotnet/runtime-deps:8.0 \
+              --connection "$PG_CONNECTION_DDL"
+            rm -f /tmp/vigilcare-records-migrate-api
+          EOF
 
   deploy:
     needs: [build-and-push, migrate]
diff --git a/VigilCareRecordsAPI/Program.cs b/VigilCareRecordsAPI/Program.cs
index be6d931..ddc99c4 100644
--- a/VigilCareRecordsAPI/Program.cs
+++ b/VigilCareRecordsAPI/Program.cs
@@ -8,6 +8,7 @@ using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Diagnostics.HealthChecks;
 using Microsoft.IdentityModel.Tokens;
 using Minio;
+using Minio.DataModel.Args;
 using Prometheus;
 using Serilog;
 using StackExchange.Redis;
@@ -233,6 +234,11 @@ try
         var db = scope.ServiceProvider.GetRequiredService<AppDbContext>();
         await db.Database.MigrateAsync();
         await DataSeeder.SeedAsync(db);
+
+        var minio = scope.ServiceProvider.GetRequiredService<IMinioClient>();
+        var minioOpts = scope.ServiceProvider.GetRequiredService<IOptions<MinioOptions>>().Value;
+        if (!await minio.BucketExistsAsync(new BucketExistsArgs().WithBucket(minioOpts.BucketName)))
+            await minio.MakeBucketAsync(new MakeBucketArgs().WithBucket(minioOpts.BucketName));
     }
 
     app.Run();
diff --git a/docs/25-gitea-cicd-docker-deploy.md b/docs/25-gitea-cicd-docker-deploy.md
index ca007a3..f30d9e8 100644
--- a/docs/25-gitea-cicd-docker-deploy.md
+++ b/docs/25-gitea-cicd-docker-deploy.md
@@ -147,7 +147,7 @@ FROM src AS migrate
 RUN dotnet ef migrations bundle ... --output /out/migrate-api
 ```
 
-CD builds `--target migrate`, copies the binary out, and runs it with a **DDL** connection string that never enters the API container. Prefer `docker build` + `docker cp` over `docker run -v` on act_runner — bind mounts resolve on the Docker host, not the job workspace.
+CD builds `--target migrate`, copies the binary out, SCPs it to the deploy host, and runs it on the `shared-services` Docker network with a **DDL** connection string that never enters the API container. Prefer `docker build` + `docker cp` over `docker run -v` on act_runner — bind mounts resolve on the Docker host, not the job workspace.
 
 ### `.dockerignore`
 
@@ -272,7 +272,7 @@ build-and-push ──► migrate ──► deploy (smoke + rollback on failure)
 
 1. Build `--target migrate`
 2. Extract `migrate-api`
-3. `./migrate-api --connection "${{ secrets.PG_CONNECTION_DDL }}"`
+3. `scp` the binary to the deploy host and `docker run --network shared-services` it with `--connection "${{ secrets.PG_CONNECTION_DDL }}"` (Postgres is on that network — not reachable from `act_runner`)
 
 Migrations must be **backwards-compatible** with the still-running previous image (expand-then-contract). Rollback restores the old image tag only — it does not reverse schema.
 
diff --git a/docs/26-vigilcare-records-cicd.md b/docs/26-vigilcare-records-cicd.md
index 52c532b..c288cd9 100644
--- a/docs/26-vigilcare-records-cicd.md
+++ b/docs/26-vigilcare-records-cicd.md
@@ -43,6 +43,20 @@ ssh deploy@YOUR_HOST "chmod 600 /opt/vigilcare-records/.env"
 
 Fill in `.env` from [`.env.example`](../.env.example) first — generate `JWT_SECRET` with `openssl rand -base64 48`, and get real credentials for the shared Postgres/Redis/MinIO/Seq services from whoever manages that stack. CD never uploads or overwrites `.env`; only the `IMAGE_TAG` line is patched automatically on each release.
 
+Create the Records MinIO bucket once (the API also creates it on startup if missing):
+
+```bash
+ssh deploy@YOUR_HOST bash -euo pipefail <<'EOF'
+cd /opt/vigilcare-records
+env_val() { sed -n "s/^${1}=//p" .env | tail -n1 | tr -d '\r'; }
+ACCESS="$(env_val MINIO_ACCESS_KEY)"
+SECRET="$(env_val MINIO_SECRET_KEY)"
+BUCKET="$(env_val MINIO_BUCKET_NAME)"; BUCKET="${BUCKET:-vigilcare-records-scans}"
+docker run --rm --network shared-services --entrypoint /bin/sh minio/mc \
+  -c "mc alias set local http://minio:9000 '${ACCESS}' '${SECRET}' && mc mb --ignore-existing local/${BUCKET}"
+EOF
+```
+
 ## 4. Gitea secrets and variables
 
 Repo → **Settings** → **Actions**.
@@ -53,7 +67,7 @@ Repo → **Settings** → **Actions**.
 |---|---|
 | `REGISTRY_USERNAME` | `docker login` |
 | `REGISTRY_TOKEN` | `docker login` (access token / PAT with package write) |
-| `PG_CONNECTION_DDL` | migrate job only — DDL-privileged connection to the shared Postgres, never given to the API container |
+| `PG_CONNECTION_DDL` | migrate job only — DDL-privileged connection (`Host=postgres` on `shared-services`), never given to the API container |
 | `DEPLOY_HOST` | SSH / SCP |
 | `DEPLOY_USER` | SSH / SCP |
 | `DEPLOY_SSH_KEY` | Private key PEM / OpenSSH private key body |
@@ -72,7 +86,7 @@ git tag v1.0.0
 git push origin v1.0.0
 ```
 
-This triggers `.gitea/workflows/cd.yml`: build & push both images → apply EF Core migrations against `PG_CONNECTION_DDL` → SSH deploy (`scp` the prod compose file, patch `IMAGE_TAG`, `pull` + `up -d`) → smoke test (`/health/ready`, dashboard `/`) → automatic rollback to the previous `IMAGE_TAG` on failure (schema changes are not reverted; see the expand/contract note in `cd.yml`).
+This triggers `.gitea/workflows/cd.yml`: build & push both images → SSH the EF migrations bundle onto the deploy host and run it on `shared-services` with `PG_CONNECTION_DDL` → SSH deploy (`scp` the prod compose file, patch `IMAGE_TAG`, `pull` + `up -d`) → smoke test (`/health/ready`, dashboard `/`) → automatic rollback to the previous `IMAGE_TAG` on failure (schema changes are not reverted; see the expand/contract note in `cd.yml`).
 
 Manual redeploy of an existing tag: Gitea UI → Actions → CD → Run workflow, with `image_tag` input.