diff --git a/services/veles/backend-deployment.yaml b/services/veles/backend-deployment.yaml
index 782e6277..89be9fc5 100644
--- a/services/veles/backend-deployment.yaml
+++ b/services/veles/backend-deployment.yaml
@@ -31,6 +31,31 @@ spec:
         fsGroupChangePolicy: OnRootMismatch
         seccompProfile:
           type: RuntimeDefault
+      initContainers:
+        - name: migrate-db
+          image: registry.bstein.dev/veles/veles-backend:0.1.0-20260611.363726bae745 # {"$imagepolicy": "veles:veles-backend"}
+          imagePullPolicy: IfNotPresent
+          command: ["veles-db"]
+          args: ["--init", "--json"]
+          envFrom:
+            - configMapRef:
+                name: veles-app-config
+            - secretRef:
+                name: veles-runtime-secrets
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 10001
+            runAsGroup: 10001
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
       containers:
         - name: backend
           image: registry.bstein.dev/veles/veles-backend:0.1.0-20260611.363726bae745 # {"$imagepolicy": "veles:veles-backend"}