diff --git a/Dockerfile b/Dockerfile
index bb5d3bd..8eef88d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -16,6 +16,8 @@ WORKDIR /app
 RUN adduser --system --group --uid 1000 app
 COPY --from=build /install /usr/local
 COPY src/ ./src/
+COPY alembic.ini ./
+COPY alembic/ ./alembic/
 
 USER 1000
 EXPOSE 8000
diff --git a/alembic/versions/003_make_users_hashed_password_nullable.py b/alembic/versions/003_make_users_hashed_password_nullable.py
new file mode 100644
index 0000000..8aec2bc
--- /dev/null
+++ b/alembic/versions/003_make_users_hashed_password_nullable.py
@@ -0,0 +1,26 @@
+"""Make users.hashed_password nullable.
+
+Better-Auth inserts users without hashed_password (passwords live in the
+accounts table). This column is now purely optional.
+
+Revision ID: 003_make_users_hashed_password_nullable
+Revises: 002_better_auth_tables
+Create Date: 2026-03-30
+"""
+
+import sqlalchemy as sa
+
+from alembic import op
+
+revision = "003_make_users_hashed_password_nullable"
+down_revision = "002_better_auth_tables"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.alter_column("users", "hashed_password", existing_type=sa.String(255), nullable=True)
+
+
+def downgrade() -> None:
+    op.alter_column("users", "hashed_password", existing_type=sa.String(255), nullable=False)