diff --git a/scripts/gitops-render.test.ts b/scripts/gitops-render.test.ts
index d265c2b3..fbbfc321 100644
--- a/scripts/gitops-render.test.ts
+++ b/scripts/gitops-render.test.ts
@@ -735,6 +735,7 @@ test("v03 render keeps node identity as data instead of generated structure", as
       Object.keys(externalPostgresMigrationConfig?.data ?? {}).filter((name) => name.endsWith(".sql")),
       CLOUD_CORE_MIGRATIONS.map((migration) => path.basename(migration.path))
     );
+    assert.match(externalPostgresMigrationConfig?.data?.["run.mjs"] ?? "", /DATABASE_URL is required/u);
     assert.equal(externalPostgresMigrationConfig?.metadata?.annotations?.["argocd.argoproj.io/sync-wave"], "-2");
     assert.equal(externalPostgresMigrationJob?.metadata?.annotations?.["argocd.argoproj.io/sync-wave"], "-1");
     assert.equal(
diff --git a/scripts/src/gitops-render/runtime-manifests.mjs b/scripts/src/gitops-render/runtime-manifests.mjs
index 4e019f3c..21784ec0 100644
--- a/scripts/src/gitops-render/runtime-manifests.mjs
+++ b/scripts/src/gitops-render/runtime-manifests.mjs
@@ -851,7 +851,9 @@ function externalPostgresMigrationRunner() {
     'const { Pool } = require("/opt/hwlab-env/node_modules/pg");',
     'const root = "/opt/hwlab-migrations";',
     'const files = (await readdir(root)).filter((name) => /^\\d+_.*\\.sql$/u.test(name)).sort();',
-    'const pool = new Pool({ connectionString: process.env.DATABASE_URL, max: 1 });',
+    'const connectionString = process.env.DATABASE_URL;',
+    'if (!connectionString) throw new Error("DATABASE_URL is required");',
+    'const pool = new Pool({ connectionString, max: 1 });',
     'try {',
     '  for (const file of files) {',
     '    await pool.query(await readFile(`${root}/${file}`, "utf8"));',