diff --git a/.github/workflows/bot.yml b/.github/workflows/bot.yml
index f81bfdc19..d18f40497 100644
--- a/.github/workflows/bot.yml
+++ b/.github/workflows/bot.yml
@@ -74,4 +74,4 @@ jobs:
       - name: Deploy updates
         env:
           TACHI_HOST: ${{ secrets.TACHI_HOST }}
-        run: ssh "ci@${TACHI_HOST}" "/home/ci/tachi-deploy/scripts/deploy-bot.sh ${{ matrix.destination }} ${{ github.sha }}"
+        run: ssh "ci@${TACHI_HOST}" "/home/ci/tachi-deploy/swarm/scripts/deploy-bot.sh ${{ matrix.destination }} ${{ github.sha }}"
diff --git a/.github/workflows/database-seeds.yml b/.github/workflows/database-seeds.yml
index 0fd41e418..cc5aedbb0 100644
--- a/.github/workflows/database-seeds.yml
+++ b/.github/workflows/database-seeds.yml
@@ -63,4 +63,4 @@ jobs:
       - name: Deploy seeds
         env:
           TACHI_HOST: ${{ secrets.TACHI_HOST }}
-        run: ssh -i ~/.ssh/id_rsa "ci@${TACHI_HOST}" /home/ci/tachi-deploy/scripts/deploy-seeds.sh "${{ github.sha }}"
+        run: ssh -i ~/.ssh/id_rsa "ci@${TACHI_HOST}" /home/ci/tachi-deploy/swarm/scripts/deploy-seeds.sh "${{ github.sha }}"
diff --git a/.github/workflows/github-bot.yml b/.github/workflows/github-bot.yml
index fa27e6e17..247409676 100644
--- a/.github/workflows/github-bot.yml
+++ b/.github/workflows/github-bot.yml
@@ -68,4 +68,4 @@ jobs:
       - name: Deploy updates
         env:
           TACHI_HOST: ${{ secrets.TACHI_HOST }}
-        run: ssh "ci@${TACHI_HOST}" "/home/ci/tachi-deploy/scripts/deploy-ghbot.sh ${{ github.sha }}"
+        run: ssh "ci@${TACHI_HOST}" "/home/ci/tachi-deploy/swarm/scripts/deploy-ghbot.sh ${{ github.sha }}"
diff --git a/.github/workflows/migration-immutability.yml b/.github/workflows/migration-immutability.yml
new file mode 100644
index 000000000..5e0513e64
--- /dev/null
+++ b/.github/workflows/migration-immutability.yml
@@ -0,0 +1,38 @@
+name: Migration immutability
+
+# Reject PRs that modify, delete, rename, or copy existing SQL migrations.
+# Adding new files under db/migrations/ is allowed.
+
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - "db/migrations/**"
+      - ".github/workflows/migration-immutability.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  no-mutation:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - name: Reject modified or deleted migrations
+        run: |
+          set -euo pipefail
+          base="${{ github.event.pull_request.base.sha }}"
+          head="${{ github.event.pull_request.head.sha }}"
+          diff_out=$(git diff --name-status "$base" "$head" -- db/migrations/)
+          bad_lines=$(printf '%s\n' "$diff_out" | awk 'NF && $1 != "A" { print }' || true)
+          if [[ -n "$bad_lines" ]]; then
+            echo "::error::SQL migrations under db/migrations/ must not be modified, deleted, renamed, or copied. Add a new migration file instead."
+            echo "$bad_lines"
+            exit 1
+          fi
diff --git a/.github/workflows/server.yml b/.github/workflows/server.yml
index 865c1fd7c..32d7d8e3b 100644
--- a/.github/workflows/server.yml
+++ b/.github/workflows/server.yml
@@ -170,4 +170,4 @@ jobs:
       - name: Deploy on server
         env:
           TACHI_HOST: ${{ secrets.TACHI_HOST }}
-        run: ssh "ci@${TACHI_HOST}" "/home/ci/tachi-deploy/scripts/deploy-server.sh ${{ matrix.destination }} ${{ github.sha }}"
+        run: ssh "ci@${TACHI_HOST}" "/home/ci/tachi-deploy/swarm/scripts/deploy-server.sh ${{ matrix.destination }} ${{ github.sha }}"