diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..1b85546
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1 @@
+migrations/*.sql text eol=crlf
diff --git a/build.rs b/build.rs
new file mode 100644
index 0000000..3a8149e
--- /dev/null
+++ b/build.rs
@@ -0,0 +1,3 @@
+fn main() {
+    println!("cargo:rerun-if-changed=migrations");
+}
diff --git a/docker/Dockerfile b/docker/Dockerfile
index 4916b4c..3260f1a 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -17,11 +17,16 @@ RUN sed -i "s|http://deb.debian.org/debian|${DEBIAN_MIRROR%/}|g" /etc/apt/source
   && rm -rf /var/lib/apt/lists/*
 
 COPY Cargo.toml Cargo.lock ./
+COPY build.rs ./
 COPY .cargo ./.cargo
 COPY src ./src
 COPY migrations ./migrations
 COPY templates ./templates
 
+# SQLx hashes migration bytes at compile time. Production was initialized from
+# CRLF migrations, so make every build reproduce those historical checksums.
+RUN sed -i 's/\r$//; s/$/\r/' migrations/*.sql
+
 RUN --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked \
     --mount=type=cache,target=/app/target,sharing=locked \
     if [ -n "$CARGO_REGISTRY_MIRROR" ]; then \
@@ -58,7 +63,7 @@ WORKDIR /app
 
 COPY --from=builder /app/imageforge ./imageforge
 COPY --from=frontend-builder /app/frontend/dist ./static
-COPY migrations ./migrations
+COPY --from=builder /app/migrations ./migrations
 
 RUN mkdir -p uploads \
   && chown imageforge:imageforge uploads