diff --git a/.gitea/workflows/ci-cd.yml b/.gitea/workflows/ci-cd.yml
index 7b61bcd53..bb0e32e2b 100755
--- a/.gitea/workflows/ci-cd.yml
+++ b/.gitea/workflows/ci-cd.yml
@@ -129,11 +129,34 @@ jobs:
           grep -q "Running upgrade" /tmp/alembic-upgrade.sql
           python3 scripts/check_schema_metadata.py
 
+      - name: Prepare git for migration diff
+        shell: sh
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          set -eu
+          if command -v git >/dev/null 2>&1; then
+            git init -q
+            git config user.email "ci@localhost"
+            git config user.name "CI"
+            git add .
+            git commit -q -m "current"
+            REPO_URL="https://x-access-token:${GITHUB_TOKEN}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git"
+            git remote add origin "$REPO_URL"
+            git fetch origin main --depth=1 -q 2>/dev/null || echo "WARN: cannot fetch main, will check all migrations"
+          else
+            echo "WARN: git not available, will check all migrations"
+          fi
+
       - name: Check migration safety
         shell: sh
         run: |
           set -eu
-          python3 scripts/check_migration_safety.py --allow-medium-risk
+          if git rev-parse origin/main >/dev/null 2>&1; then
+            python3 scripts/check_migration_safety.py --allow-medium-risk --diff-against origin/main
+          else
+            python3 scripts/check_migration_safety.py --allow-medium-risk
+          fi
 
       - name: Run unit tests
         shell: sh