diff --git a/Dockerfile.migrate b/Dockerfile.migrate
index b9a72e1..79bc5b0 100644
--- a/Dockerfile.migrate
+++ b/Dockerfile.migrate
@@ -10,9 +10,19 @@ RUN rustup target add x86_64-unknown-linux-musl
 
 COPY Cargo.toml Cargo.lock ./
 COPY crates/db-migrate ./crates/db-migrate
-COPY crates/db ./crates/db
-COPY crates/cache ./crates/cache
-COPY crates/email ./crates/email
+
+# The root Cargo.toml's [workspace] members list includes every apps/* service,
+# none of which are copied into this image (db-migrate has no path dependency
+# on them - see crates/db-migrate/Cargo.toml). Restrict the workspace to just
+# this crate so cargo doesn't fail trying to resolve manifests that don't exist
+# in this build context (same trick Dockerfile.simple uses per-service).
+RUN awk '\
+  BEGIN { in_members = 0 } \
+  /^members = \[/ { print "members = [\n  \"crates/db-migrate\"\n]"; in_members = 1; next } \
+  in_members && /^\]/ { in_members = 0; next } \
+  in_members { next } \
+  { print } \
+' Cargo.toml > Cargo.toml.trimmed && mv Cargo.toml.trimmed Cargo.toml
 
 WORKDIR /app/crates/db-migrate
 ENV OPENSSL_STATIC=1
@@ -22,7 +32,7 @@ RUN cargo build --release --bin db-migrate --target x86_64-unknown-linux-musl
 FROM ci.nxtgauge.com/admin/alpine:3.20
 RUN apk add --no-cache ca-certificates libpq
 
-COPY --from=builder /app/crates/db-migrate/target/x86_64-unknown-linux-musl/release/db-migrate /usr/local/bin/
+COPY --from=builder /app/target/x86_64-unknown-linux-musl/release/db-migrate /usr/local/bin/
 COPY crates/db/migrations /migrations
 
 ENTRYPOINT ["db-migrate"]
diff --git a/k8s-migration-job.yaml b/k8s-migration-job.yaml
index b594bca..9d3e25f 100644
--- a/k8s-migration-job.yaml
+++ b/k8s-migration-job.yaml
@@ -2,7 +2,7 @@ apiVersion: batch/v1
 kind: Job
 metadata:
   name: nxtgauge-db-migrate
-  namespace: default
+  namespace: nxtgauge
   labels:
     app: nxtgauge-db-migrate
 spec:
@@ -14,6 +14,8 @@ spec:
         app: nxtgauge-db-migrate
     spec:
       restartPolicy: OnFailure
+      imagePullSecrets:
+        - name: forgejo-regcred
       containers:
         - name: migrate
           image: ci.nxtgauge.com/ashwin/nxtgauge-db-migrate:high-performance-latest