diff --git a/.github/workflows/porter_app_evals_3155.yml b/.github/workflows/porter_app_evals_3155.yml
index c14754abd..29e5b87a7 100644
--- a/.github/workflows/porter_app_evals_3155.yml
+++ b/.github/workflows/porter_app_evals_3155.yml
@@ -4,11 +4,58 @@
             - evals
 name: Deploy to evals
 jobs:
+    database-deploy:
+      runs-on: blacksmith-16vcpu-ubuntu-2204
+      environment: staging
+      steps:
+        - name: Checkout code
+          uses: actions/checkout@v3
+
+        - name: Install Rust
+          uses: actions-rs/toolchain@v1
+          with:
+            toolchain: stable
+            profile: minimal
+            override: true
+
+        - name: Cache Rust dependencies
+          uses: Swatinem/rust-cache@v2
+
+        - name: Install Diesel CLI
+          run: cargo install diesel_cli --no-default-features --features postgres
+
+        - name: Configure AWS Credentials
+          uses: aws-actions/configure-aws-credentials@v4
+          with:
+            aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+            aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+            aws-region: ${{ secrets.AWS_REGION }}
+
+        - name: Download Postgres certificate from S3
+          run: |
+            mkdir -p ~/.postgresql
+            aws s3 cp ${{ secrets.CERT_S3_URL }} ~/.postgresql/root.crt
+
+        - name: Run migrations
+          working-directory: ./api
+          run: diesel migration run
+          env:
+            DATABASE_URL: ${{ secrets.EVAL_DB_URL }}
+            PGSSLMODE: disable
     porter-deploy:
         runs-on: ubuntu-latest
         steps:
             - name: Checkout code
               uses: actions/checkout@v4
+            - name: Configure AWS Credentials
+              uses: aws-actions/configure-aws-credentials@v4
+              with:
+                aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+                aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+                aws-region: ${{ secrets.AWS_REGION }}
+            - name: Download SSL certificate from S3
+              run: |
+                aws s3 cp ${{ secrets.CERT_S3_URL }} ./api/cert.pem
             - name: Set Github tag
               id: vars
               run: echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT