diff --git a/.gitignore b/.gitignore
index d9d031aab3..efa47b920d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,6 +3,7 @@
 .env
 .env-aichatbot-secrets
 .env-elasticsearch-secrets
+.env-migration-tool-secrets
 .env-secrets
 _develop/tools/.secrets
 _develop/tools/db_secrets.toml
@@ -17,6 +18,9 @@ secrets.toml
 secrets.yaml
 twitch_secrets.toml
 
+# Old env secrets
+.*-secrets
+
 # New env secrets (per-app)
 *-secrets.env
 
diff --git a/Cargo.lock b/Cargo.lock
index 7af174d2be..a6a2c3ec3d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3480,6 +3480,29 @@ dependencies = [
  "my-workspace-hack",
 ]
 
+[[package]]
+name = "migration-tool"
+version = "0.0.1"
+dependencies = [
+ "buckets",
+ "clap",
+ "config",
+ "easyenv",
+ "enums",
+ "errors",
+ "log",
+ "my-workspace-hack",
+ "mysql_queries",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "sqlx",
+ "storyteller_root",
+ "strum",
+ "tokens",
+ "tokio",
+]
+
 [[package]]
 name = "mime"
 version = "0.3.17"
diff --git a/Cargo.toml b/Cargo.toml
index 411f131e53..e0a47f555a 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -17,6 +17,7 @@ members = [
   "crates/cli/elasticsearch-cli",
   "crates/cli/kubectl-pod-cleanup",
   "crates/cli/lru-delete-models",
+  "crates/cli/migration-tool",
   "crates/cli/scrape_test",
 
   # Shared libraries
diff --git a/crates/cli/migration-tool/Cargo.toml b/crates/cli/migration-tool/Cargo.toml
new file mode 100644
index 0000000000..2c7d4b065c
--- /dev/null
+++ b/crates/cli/migration-tool/Cargo.toml
@@ -0,0 +1,44 @@
+[package]
+name = "migration-tool"
+edition = "2018"
+version = "0.0.1"
+authors = [
+    "Brandon Thomas <bt@brand.io>",
+    "Brandon Thomas <echelon@gmail.com>",
+]
+publish = false
+
+[[bin]]
+name = "migration-tool"
+path = "src/main.rs"
+
+[dependencies]
+# Internal
+buckets = { path = "../../_types/buckets" }
+config = { path = "../../lib/deprecated/config" }
+easyenv = { path = "../../lib/easyenv" }
+enums = { path = "../../_types/enums" }
+errors = { path = "../../lib/errors" }
+mysql_queries = { path = "../../lib/mysql_queries" }
+storyteller_root = { path = "../../lib/storyteller_root" }
+tokens = { path = "../../_types/tokens" }
+
+# Workspace hack (faster compile times)
+my-workspace-hack = { version = "0.1", path = "../../my-workspace-hack" }
+
+# External
+clap = "4.4.8"
+log = "0.4.14"
+strum = { version = "0.25", features = ["derive"] }
+
+# Async + clients
+tokio = { version = "1.34.0", features = ["macros"] }
+sqlx = { version = "0.7.2", features = [ "mysql", "runtime-tokio", "tls-rustls", "chrono" ] }
+
+# Serialization
+serde = "1.0.125"
+serde_derive = "1.0.125"
+serde_json = "1.0.108"
+
+[dev-dependencies]
+# None yet
diff --git a/crates/cli/migration-tool/src/main.rs b/crates/cli/migration-tool/src/main.rs
new file mode 100644
index 0000000000..dd6af54df8
--- /dev/null
+++ b/crates/cli/migration-tool/src/main.rs
@@ -0,0 +1,23 @@
+//! migration-tool
+//!
+//! Migrate database records.
+//!
+
+
+use config::shared_constants::DEFAULT_RUST_LOG;
+use errors::AnyhowResult;
+
+#[tokio::main]
+pub async fn main() -> AnyhowResult<()> {
+  println!("migration-tool: migrate database records");
+
+  easyenv::init_all_with_default_logging(Some(DEFAULT_RUST_LOG));
+
+  // NB: This secrets file differs from the rest because we might actually want to cross
+  // development/production boundaries for migration. We don't want to pull in secrets
+  // from other sources. (Hopefully this isn't getting out of hand at this point.)
+  easyenv::from_filename(".env-migration-tool-secrets")?;
+
+
+  Ok(())
+}