I realised that I could just build another pex solely for running the alembic. Then every time I need to run a new migration, I can just spin up a temporary k8s pod that runs the alembic migration. Feels fine to me because that also means I don't need to package the alembic artifacts into the actual binary