diff --git a/modules/services/web/rails/db-migrate.sh b/modules/services/web/rails/db-migrate.sh
index 14d4bca..879096b 100755
--- a/modules/services/web/rails/db-migrate.sh
+++ b/modules/services/web/rails/db-migrate.sh
@@ -9,6 +9,7 @@ set -u
 ################################################################################
 option_env=${RAILS_ENV:-production}
 option_root=$(pwd)
+option_statedir=$(pwd)/state
 
 ################################################################################
 usage () {
@@ -18,11 +19,12 @@ Usage: db-migrate.sh [options]
   -e NAME Set RAILS_ENV to NAME
   -h      This message
   -r DIR  The root directory of the Rails app
+  -s DIR  Directory where state files can be stored
 EOF
 }
 
 ################################################################################
-while getopts "he:r:" o; do
+while getopts "he:r:s:" o; do
   case "${o}" in
     e) option_env=$OPTARG
        ;;
@@ -34,6 +36,9 @@ while getopts "he:r:" o; do
     r) option_root=$OPTARG
        ;;
 
+    s) option_statedir=$OPTARG
+       ;;
+
     *) exit 1
        ;;
   esac
@@ -47,9 +52,9 @@ export RAILS_ENV=$option_env
 
 ################################################################################
 # If this is a new database, load the schema file:
-if [ ! -e config/database-loaded.flag ]; then
+if [ ! -e "$option_statedir/database-loaded.flag" ]; then
   rake db:schema:load
-  touch config/database-loaded.flag
+  touch "$option_statedir/database-loaded.flag"
 fi
 
 ################################################################################
diff --git a/modules/services/web/rails/default.nix b/modules/services/web/rails/default.nix
index d7c4291..990dc81 100644
--- a/modules/services/web/rails/default.nix
+++ b/modules/services/web/rails/default.nix
@@ -66,7 +66,7 @@ let
         DATABASE_PORT = toString app.database.port;
         DATABASE_NAME = app.database.name;
         DATABASE_USER = app.database.user;
-        DATABASE_PASSWORD_FILE = "${app.home}/config/database.password";
+        DATABASE_PASSWORD_FILE = "${app.home}/state/database.password";
       } // app.environment;
 
       wantedBy = [ "multi-user.target" ];
@@ -78,11 +78,12 @@ let
       preStart = ''
         # Prepare the config directory:
         rm -rf ${app.home}/config
-        mkdir -p ${app.home}/{config,log,tmp,db}
+        mkdir -p ${app.home}/{config,log,tmp,db,state}
+
         cp -rf ${app.package}/share/${app.name}/config.dist/* ${app.home}/config/
         cp ${app.package}/share/${app.name}/db/schema.rb.dist ${app.home}/db/schema.rb
         cp ${./database.yml} ${app.home}/config/database.yml
-        cp ${app.database.passwordFile} ${app.home}/config/database.password
+        cp ${app.database.passwordFile} ${app.home}/state/database.password
 
         mkdir -p ${app.home}/home
         ln -nfs ${app.package}/share/${app.name} ${app.home}/home/${app.name}
@@ -95,7 +96,9 @@ let
       '' + optionalString app.database.migrate ''
         # Migrate the database (use sudo so environment variables go through):
         ${pkgs.sudo}/bin/sudo -u rails-${app.name} -EH \
-          ${scripts}/bin/db-migrate.sh -r ${app.package}/share/${app.name}
+          ${scripts}/bin/db-migrate.sh \
+            -r ${app.package}/share/${app.name} \
+            -s ${app.home}/state
       '';
 
       serviceConfig = {