diff --git a/Makefile b/Makefile
index 2cf3744..876111e 100644
--- a/Makefile
+++ b/Makefile
@@ -1,5 +1,5 @@
 BINARY=syncserver
-VERSION?=1.0.58
+VERSION?=1.0.59
 GO?=go
 LDFLAGS=-s -w -X main.version=$(VERSION) -X main.commit=$(shell git rev-parse --short HEAD 2>/dev/null || echo unknown)
 BUILD_FLAGS=CGO_ENABLED=0
diff --git a/cmd/server/main.go b/cmd/server/main.go
index f4102b6..800a384 100644
--- a/cmd/server/main.go
+++ b/cmd/server/main.go
@@ -20,7 +20,7 @@ import (
 	"github.com/syncserver/internal/syncengine"
 )
 
-var version = "1.0.58"
+var version = "1.0.59"
 
 func main() {
 	cfgPath := flag.String("config", "", "Path to config.yaml")
diff --git a/internal/db/db.go b/internal/db/db.go
index eb9d836..9112e0e 100644
--- a/internal/db/db.go
+++ b/internal/db/db.go
@@ -86,10 +86,28 @@ func (db *DB) runMigrationsInternal(mfs embedFS, migrationsRoot string) error {
 
 	for _, name := range names {
 		if hasChecksumCol {
-			var storedChecksum string
+			var storedChecksum sql.NullString
 			row := db.QueryRow("SELECT checksum FROM schema_migrations WHERE version = ?", name)
-			if err := row.Scan(&storedChecksum); err == nil && storedChecksum != "" {
+			switch err := row.Scan(&storedChecksum); {
+			case err == nil:
+				if storedChecksum.Valid && storedChecksum.String != "" {
+					continue
+				}
+				data, err := mfs.ReadFile(filepath.Join(migrationsRoot, name))
+				if err != nil {
+					return fmt.Errorf("reading migration %s: %w", name, err)
+				}
+				checksum := sha256.Sum256(data)
+				if _, err := db.Exec(
+					"UPDATE schema_migrations SET checksum = ? WHERE version = ?",
+					hex.EncodeToString(checksum[:]), name,
+				); err != nil {
+					return fmt.Errorf("backfilling checksum for %s: %w", name, err)
+				}
 				continue
+			case err == sql.ErrNoRows:
+			default:
+				return fmt.Errorf("checking migration %s: %w", name, err)
 			}
 		} else {
 			var count int