diff --git a/Dockerfile b/Dockerfile
index c0561a5..c97d16a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -29,7 +29,14 @@ RUN set -eu; \
         -X git.warky.dev/wdevs/amcs/internal/buildinfo.TagName=${VERSION_TAG} \
         -X git.warky.dev/wdevs/amcs/internal/buildinfo.Commit=${COMMIT_SHA} \
         -X git.warky.dev/wdevs/amcs/internal/buildinfo.BuildDate=${BUILD_DATE}" \
-      -o /out/amcs-server ./cmd/amcs-server
+      -o /out/amcs-server ./cmd/amcs-server; \
+    CGO_ENABLED=0 GOOS=linux go build -trimpath \
+      -ldflags="-s -w \
+        -X git.warky.dev/wdevs/amcs/internal/buildinfo.Version=${VERSION_TAG} \
+        -X git.warky.dev/wdevs/amcs/internal/buildinfo.TagName=${VERSION_TAG} \
+        -X git.warky.dev/wdevs/amcs/internal/buildinfo.Commit=${COMMIT_SHA} \
+        -X git.warky.dev/wdevs/amcs/internal/buildinfo.BuildDate=${BUILD_DATE}" \
+      -o /out/amcs-migrate-config ./cmd/amcs-migrate-config
 
 FROM debian:bookworm-slim
 
@@ -41,6 +48,7 @@ RUN apt-get update \
 WORKDIR /app
 
 COPY --from=builder /out/amcs-server /app/amcs-server
+COPY --from=builder /out/amcs-migrate-config /app/amcs-migrate-config
 COPY --chown=appuser:appuser configs /app/configs
 
 USER appuser
diff --git a/README.md b/README.md
index 2f626c8..b9219e3 100644
--- a/README.md
+++ b/README.md
@@ -654,6 +654,22 @@ Notes:
 - Database migrations `001` through `005` run automatically when the Postgres volume is created for the first time.
 - `migrations/006_rls_and_grants.sql` is intentionally skipped during container bootstrap because it contains deployment-specific grants for a role named `amcs_user`.
 
+### Run config migration with Compose
+
+The container image now includes `/app/amcs-migrate-config`.
+
+Dry-run (prints migrated YAML, does not write files):
+
+```bash
+docker compose --profile tools run --rm migrate-config --config /app/configs/dev.yaml --dry-run
+```
+
+Apply migration in-place (writes file + creates backup):
+
+```bash
+docker compose --profile tools run --rm migrate-config --config /app/configs/dev.yaml
+```
+
 ## Ollama
 
 Set your role targets to an Ollama provider to use a local or self-hosted Ollama server through its OpenAI-compatible API.
diff --git a/changelog.md b/changelog.md
index 5e64c3a..1a563e8 100644
--- a/changelog.md
+++ b/changelog.md
@@ -78,3 +78,8 @@
 - New: `internal/ai/runner_test.go`
 - New: `internal/config/migrate.go`
 - New: `internal/config/migrate_test.go`
+
+### 2026-04-21 21h - Docker Support for Config Migration CLI
+- Added `amcs-migrate-config` binary to the Docker image build output.
+- Added `migrate-config` service in `docker-compose.yml` under the `tools` profile.
+- Documented compose-based migration commands (dry-run and in-place apply) in the README.
diff --git a/docker-compose.yml b/docker-compose.yml
index 6d9bcc4..ce57a31 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -36,6 +36,18 @@ services:
     ports:
       - "8080:8080"
 
+  migrate-config:
+    build:
+      context: .
+    profiles: ["tools"]
+    restart: "no"
+    volumes:
+      - ./configs:/app/configs
+    environment:
+      AMCS_CONFIG: /app/configs/docker.yaml
+    entrypoint: ["/app/amcs-migrate-config"]
+    command: ["--config", "/app/configs/docker.yaml", "--dry-run"]
+
 volumes:
   postgres_data: