diff --git a/Dockerfile b/Dockerfile
index 0645f05..d83fa9f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,15 +1,20 @@
 # Multi-stage build for tenant-registry.
+# Produces two binaries:
+#   /tenant-registry  — long-running API server
+#   /migrate          — one-shot schema migrator (Orca init container in prod)
 
 FROM golang:1.24-alpine AS build
 WORKDIR /src
-COPY go.mod ./
+COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
-RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o /out/tenant-registry ./cmd/server
+RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o /out/tenant-registry ./cmd/server && \
+    CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o /out/migrate         ./cmd/migrate
 
 FROM gcr.io/distroless/static-debian12:nonroot
 WORKDIR /
 COPY --from=build /out/tenant-registry /tenant-registry
+COPY --from=build /out/migrate         /migrate
 USER nonroot:nonroot
 EXPOSE 8090
 ENTRYPOINT ["/tenant-registry"]