diff --git a/.gitea/workflows/ci-cd.yml b/.gitea/workflows/ci-cd.yml
index bdb5ba4..527bcfc 100644
--- a/.gitea/workflows/ci-cd.yml
+++ b/.gitea/workflows/ci-cd.yml
@@ -66,6 +66,9 @@ jobs:
           git config http.extraheader "Authorization: Bearer ${TOKEN}"
           git fetch --depth=1 origin "${REF}"
           git checkout -f FETCH_HEAD
+          # Remove stale Docker-created bind-mount dirs from a previous run (e.g. an
+          # empty scripts/init-db.sh dir) so they don't shadow real files. -e keeps .env.
+          git clean -ffd -e .env || true
 
       - name: Write .env (from ENV_FILE secret)
         run: printf '%s' "$ENV_FILE" > .env
diff --git a/scripts/init-db.sh b/deploy/postgres-initdb/00-init.sh
similarity index 65%
rename from scripts/init-db.sh
rename to deploy/postgres-initdb/00-init.sh
index 9c723b1..e5e55bb 100644
--- a/scripts/init-db.sh
+++ b/deploy/postgres-initdb/00-init.sh
@@ -1,7 +1,8 @@
 #!/bin/bash
 # FlatRender V2 — run all schema migrations in order on first postgres init.
-# Mounted at: /docker-entrypoint-initdb.d/00-init.sh
-# Migrations dir mounted at: /migrations  (read-only)
+# This whole directory is mounted at /docker-entrypoint-initdb.d (a DIRECTORY mount
+# is robust; a single-file bind mount can leave a stale empty dir in a reused CI
+# workspace → "Is a directory"). Migrations dir mounted read-only at /migrations.
 set -e
 
 MIGRATIONS_DIR="/migrations"
diff --git a/docker-compose.v2.yml b/docker-compose.v2.yml
index 8a96064..a8191c0 100644
--- a/docker-compose.v2.yml
+++ b/docker-compose.v2.yml
@@ -27,7 +27,8 @@ services:
       - pgdata:/var/lib/postgresql/data
       # migrations are run once by init-db.sh when the data volume is first created
       - ./backend/db/migrations:/migrations:ro
-      - ./scripts/init-db.sh:/docker-entrypoint-initdb.d/00-init.sh:ro
+      # Directory mount (NOT a single file) — robust against stale CI-workspace dirs.
+      - ./deploy/postgres-initdb:/docker-entrypoint-initdb.d:ro
     ports:
       # HOST_BIND=127.0.0.1 in prod keeps these off the public interface (only
       # Caddy's 80/443 face the internet). Unset → 0.0.0.0 for local/LAN dev.