diff --git a/.gitea/workflows/deploy-service-couchdb.yaml b/.gitea/workflows/deploy-service-couchdb.yaml
index 45452fc..8d410f3 100644
--- a/.gitea/workflows/deploy-service-couchdb.yaml
+++ b/.gitea/workflows/deploy-service-couchdb.yaml
@@ -23,16 +23,15 @@ jobs:
         env:
           COUCHDB_USER: ${{secrets.COUCHDB_USER}}
           COUCHDB_PASSWORD: ${{secrets.COUCHDB_PASSWORD}}
-        run: COUCHDB_TAG=${{env.GITHUB_SHA}} docker compose -p hereconnect up -d --pull never
-
+        run: COUCHDB_TAG=${{env.GITHUB_SHA}} docker compose -p hereconnect up -d --pull never couchdb
       - name: rename to latest
         run: docker tag hereconnect/service-couchdb:${{env.GITHUB_SHA}} hereconnect/service-couchdb:latest
 
-      - name: rollback on Failure
+      - name: rollback on failure
         if: failure()
         env:
           COUCHDB_TAG: latest
-        run: docker compose -p hereconnect up --pull never
+        run: docker compose -p hereconnect up -d --pull never couchdb
 
       - name: cleanup docker image
         if: always()
diff --git a/.gitea/workflows/deploy-service-db-migrations.yaml b/.gitea/workflows/deploy-service-db-migrations.yaml
new file mode 100644
index 0000000..d2913d5
--- /dev/null
+++ b/.gitea/workflows/deploy-service-db-migrations.yaml
@@ -0,0 +1,34 @@
+name: Deploy db-migrations
+run-name: ${{ github.actor }} deployed to build branch
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'services/db-migrate/**'
+      - '.gitea/workflows/deploy-db-migrate.yaml'
+
+jobs:
+  db-migrations:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - name: install dependencies
+        run: |
+          corepack enable pnpm && corepack use pnpm@8.15.9
+          pnpm --filter ./services/db-migrations deploy --prod build/service-db-migrations
+
+      - name: build docker image
+        run: docker build --file services/db-migrations/Dockerfile -t hereconnect/service-db-migrations:${{env.GITHUB_SHA}} build/service-db-migrations
+
+      - name: start container
+        run: DB_MIGRATIONS_TAG=${{env.GITHUB_SHA}} API_URL='http://${{secrets.COUCHDB_USER}}:${{secrets.COUCHDB_PASSWORD}}@127.0.0.1:15984' docker compose -p hereconnect up -d --pull never db-migrations
+
+      - name: cleanup docker image
+        if: always()
+        run: docker rmi hereconnect/service-db-migrations:${{env.GITHUB_SHA}}
diff --git a/.gitea/workflows/deploy-service-message-delivery-method-web-push.yaml b/.gitea/workflows/deploy-service-message-delivery-method-web-push.yaml
index b39a6c4..aed9ef2 100644
--- a/.gitea/workflows/deploy-service-message-delivery-method-web-push.yaml
+++ b/.gitea/workflows/deploy-service-message-delivery-method-web-push.yaml
@@ -41,4 +41,4 @@ jobs:
       - name: cleanup build directories
         if: always()
         run: |
-          docker rmi hereconnect/service-message-delivery-method-web-push:${{env.GITHUB_SHA}}
\ No newline at end of file
+          docker rmi hereconnect/service-message-delivery-method-web-push:${{env.GITHUB_SHA}}
diff --git a/docker-compose.yml b/docker-compose.yml
index c627a51..c8ac7a6 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -20,5 +20,14 @@ services:
         max-size: "100m"
         max-file: "10"
 
+  db-migrations:
+    image: hereconnect/service-db-migrations:${DB_MIGRATIONS_TAG:-latest}
+    volumes:
+      - db_migrations_data:/opt/migrations/data
+    depends_on:
+      - couchdb
+    restart: no
+
 volumes:
   couchdb_data:
+  db_migrations_data:
diff --git a/services/db-migrations/.dockerignore b/services/db-migrations/.dockerignore
new file mode 100644
index 0000000..d4d7e3f
--- /dev/null
+++ b/services/db-migrations/.dockerignore
@@ -0,0 +1,3 @@
+node_modules
+dist
+*.log
diff --git a/services/db-migrations/.gitignore b/services/db-migrations/.gitignore
index 8ca80b8..39dd03e 100644
--- a/services/db-migrations/.gitignore
+++ b/services/db-migrations/.gitignore
@@ -1 +1 @@
-.migrate
+.migrate
\ No newline at end of file
diff --git a/services/db-migrations/.migrate b/services/db-migrations/.migrate
new file mode 100644
index 0000000..80cf275
--- /dev/null
+++ b/services/db-migrations/.migrate
@@ -0,0 +1,9 @@
+{
+  "lastRun": "1732483677017-dbs.js",
+  "migrations": [
+    {
+      "title": "1732483677017-dbs.js",
+      "timestamp": 1733125611801
+    }
+  ]
+}
\ No newline at end of file
diff --git a/services/db-migrations/Dockerfile b/services/db-migrations/Dockerfile
new file mode 100644
index 0000000..22c40b4
--- /dev/null
+++ b/services/db-migrations/Dockerfile
@@ -0,0 +1,7 @@
+FROM oven/bun:1.1.38-alpine
+
+VOLUME /opt/migrations/data
+
+COPY . ./
+
+CMD ["bun", "./node_modules/migrate/bin/migrate", "-f", "/opt/migrations/data/migrations.json"]
diff --git a/services/db-migrations/migrations/1732483677017-dbs.js b/services/db-migrations/migrations/1732483677017-dbs.js
index ee2a6e5..313df66 100644
--- a/services/db-migrations/migrations/1732483677017-dbs.js
+++ b/services/db-migrations/migrations/1732483677017-dbs.js
@@ -1,6 +1,23 @@
 import { fetch } from "pouchdb-fetch";
 
 const dbsSecurity = {
+  _users: {
+    admins: { roles: ["_admin"] },
+    members: { roles: ["_admin"] },
+  },
+  _replicator: {
+    admins: { roles: ["_admin"] },
+    members: { roles: ["_admin"] },
+  },
+  _global_changes: {
+    admins: { roles: ["_admin"] },
+    members: { roles: ["_admin"] },
+  },
+
+  server_settings: {
+    admins: { roles: ["_admin"] },
+    members: { roles: ["_admin"] },
+  },
   web_push_subscriptions: {
     admins: { roles: ["_admin"] },
     members: { roles: [] },
@@ -9,10 +26,6 @@ const dbsSecurity = {
     admins: { roles: ["_admin"] },
     members: { roles: [] },
   },
-  server_settings: {
-    admins: { roles: ["_admin"] },
-    members: { roles: ["_admin"] },
-  },
   qr: {
     admins: { roles: ["_admin"] },
     members: { roles: [] },
diff --git a/services/db-migrations/package.json b/services/db-migrations/package.json
index a38f91a..d6a9342 100644
--- a/services/db-migrations/package.json
+++ b/services/db-migrations/package.json
@@ -14,5 +14,8 @@
     "pouchdb-core": "^9.0.0",
     "pouchdb-fetch": "^9.0.0",
     "pouchdb-find": "^9.0.0"
+  },
+  "scripts": {
+    "migrate": "migrate"
   }
 }