diff --git a/packages/db/src/migrate-assets.ts b/packages/db/src/migrate-assets.ts
index 1caaeb5..8ae566e 100644
--- a/packages/db/src/migrate-assets.ts
+++ b/packages/db/src/migrate-assets.ts
@@ -26,9 +26,21 @@ import {
 import * as schema from './schema/index';
 import { readSsl } from './client';
 
-for (const line of readFileSync(new URL('../../../.env', import.meta.url), 'utf8').split('\n')) {
-  const m = /^([A-Z_]+)=(.*)$/.exec(line.trim());
-  if (m?.[1]) process.env[m[1]] ??= m[2];
+/*
+ * The repo-root .env, when there is one.
+ *
+ * `??=` means a variable already in the environment always wins, which is what
+ * makes this safe to skip: in a container there is no .env and the platform
+ * supplies everything directly. Insisting on the file turned this script into
+ * the one step of a deployment that could not run on the server it deploys to.
+ */
+try {
+  for (const line of readFileSync(new URL('../../../.env', import.meta.url), 'utf8').split('\n')) {
+    const m = /^([A-Z_]+)=(.*)$/.exec(line.trim());
+    if (m?.[1]) process.env[m[1]] ??= m[2];
+  }
+} catch {
+  // No .env — expected anywhere the environment is injected rather than filed.
 }
 
 const url = process.env.DATABASE_URL;