diff --git a/README.md b/README.md
index abbdfa12..e2b49efb 100644
--- a/README.md
+++ b/README.md
@@ -85,8 +85,25 @@ python generate_migrations.py -m migration_name
 ```
 
 and commit them to git. Once your updated code has been
-deployed on AWS, you can use `aws ecs execute-command`
-to run the migrations.
+deployed on AWS, you can connect to the container via
+the [AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html).
+Run `aws sso login` first, then `aws ecs execute-command`
+to access a shell in the container:
+
+```shell
+aws ecs execute-command \
+--cluster <cluster-id> \
+--task <task-id> \
+--container FastAPIContainer \
+--command "/bin/sh" \
+--interactive
+```
+
+and run the migrations:
+
+```shell
+uv run alembic upgrade head
+```
 
 # Deployment
 
diff --git a/db/setup.py b/db/setup.py
index 82076ece..09052630 100644
--- a/db/setup.py
+++ b/db/setup.py
@@ -1,9 +1,12 @@
+import logging
 import os
 from typing import Tuple
 
 from dotenv import dotenv_values
 from sqlmodel import Session, SQLModel, create_engine
 
+log = logging.getLogger('uvicorn.error')
+
 
 def get_db_config() -> Tuple[str, dict]:
     """
@@ -40,7 +43,12 @@ def get_db_config() -> Tuple[str, dict]:
 
 
 def create_db_and_tables():
-    SQLModel.metadata.create_all(engine)
+    # NOTE: we only do this in dev (with sqlite).
+    # For production, we manage the DB schema with alembic
+    db_url, connect_args = get_db_config()
+    if db_url.startswith("sqlite://"):
+        log.info("Automatically creating DB tables for sqlite")
+        SQLModel.metadata.create_all(engine)
 
 
 def get_db_session():
diff --git a/migrations/versions/e55434038b96_status_enum.py b/migrations/versions/e55434038b96_status_enum.py
new file mode 100644
index 00000000..b81eb7f5
--- /dev/null
+++ b/migrations/versions/e55434038b96_status_enum.py
@@ -0,0 +1,37 @@
+"""status_enum
+
+Revision ID: e55434038b96
+Revises: 101f45395233
+Create Date: 2025-07-03 09:41:04.657535
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+import sqlmodel
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'e55434038b96'
+down_revision: Union[str, None] = '101f45395233'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.alter_column('groupmembership', 'approval_status',
+               existing_type=sa.VARCHAR(),
+               type_=sa.Enum('APPROVED', 'PENDING', 'REVOKED', name='ApprovalStatusEnum'),
+               existing_nullable=False)
+    # ### end Alembic commands ###
+
+
+def downgrade() -> None:
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.alter_column('groupmembership', 'approval_status',
+               existing_type=sa.Enum('APPROVED', 'PENDING', 'REVOKED', name='ApprovalStatusEnum'),
+               type_=sa.VARCHAR(),
+               existing_nullable=False)
+    # ### end Alembic commands ###