diff --git a/.gitignore b/.gitignore
index d08195b..2a9f1ca 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,10 +1,5 @@
 work/
 /import
 ka-note/server/ka-note.db-wal
-ka-note/server/ka-note.db-wal
-ka-note/server/ka-note.db-wal
 ka-note/server/ka-note.db-shm
-ka-note/server/ka-note.db-shm
-ka-note/server/ka-note.db-wal
-ka-note/server/ka-note.db-shm
-ka-note/server/ka-note.db-wal
+
diff --git a/ka-note/VERSION b/ka-note/VERSION
index c15c45a..a2ece8c 100644
--- a/ka-note/VERSION
+++ b/ka-note/VERSION
@@ -1 +1 @@
-1.1.85
\ No newline at end of file
+1.1.87
\ No newline at end of file
diff --git a/ka-note/deploy.ps1 b/ka-note/deploy.ps1
index bf6316f..244278b 100644
--- a/ka-note/deploy.ps1
+++ b/ka-note/deploy.ps1
@@ -106,6 +106,22 @@ az webapp config appsettings set --name $APP --resource-group $RG --settings `
   AZURE_CLIENT_ID=$env:AZURE_CLIENT_ID `
   AZURE_TENANT_ID=$env:AZURE_TENANT_ID | Out-Null
 
+Write-Host "=== Graceful DB shutdown ===" -ForegroundColor Cyan
+$AppUrl = "https://$APP.azurewebsites.net"
+if ($env:KA_NOTE_DEPLOY_API_KEY) {
+  try {
+    $shutdownResult = Invoke-RestMethod -Uri "$AppUrl/api/admin/shutdown" -Method POST `
+      -Headers @{ Authorization = "Bearer $env:KA_NOTE_DEPLOY_API_KEY" } `
+      -UseBasicParsing -TimeoutSec 10
+    Write-Host "  Shutdown response: $($shutdownResult.message)" -ForegroundColor DarkGray
+    Start-Sleep -Seconds 3
+  } catch {
+    Write-Host "  Shutdown call failed (continuing anyway): $_" -ForegroundColor Yellow
+  }
+} else {
+  Write-Host "  KA_NOTE_DEPLOY_API_KEY not set, skipping graceful shutdown" -ForegroundColor Yellow
+}
+
 Write-Host "=== Restart App Service ===" -ForegroundColor Cyan
 az webapp restart --name $APP --resource-group $RG
 
diff --git a/ka-note/server/ka-note.db-shm b/ka-note/server/ka-note.db-shm
index a2ffbaa..9d33ede 100644
Binary files a/ka-note/server/ka-note.db-shm and b/ka-note/server/ka-note.db-shm differ
diff --git a/ka-note/server/ka-note.db-wal b/ka-note/server/ka-note.db-wal
index 6fd2345..d78ed95 100644
Binary files a/ka-note/server/ka-note.db-wal and b/ka-note/server/ka-note.db-wal differ
diff --git a/ka-note/server/src/routes/admin.ts b/ka-note/server/src/routes/admin.ts
index 885b291..12e5f68 100644
--- a/ka-note/server/src/routes/admin.ts
+++ b/ka-note/server/src/routes/admin.ts
@@ -3,6 +3,7 @@ import { vacuumPurged } from '../lib/sync-service.js';
 import { checkIntegrity } from '../lib/backup-service.js';
 import { handle } from '../lib/route-utils.js';
 import type { AuthEnv } from '../middleware/auth.js';
+import { sqlite } from '../db/connection.js';
 
 const admin = new Hono<AuthEnv>();
 
@@ -18,4 +19,21 @@ admin.get('/integrity', handle('admin/integrity', async (c) => {
   return c.json(result, result.ok ? 200 : 500);
 }));
 
+// Graceful shutdown: checkpoint WAL, close DB, exit.
+// Call from deploy pipeline before restarting the container.
+admin.post('/shutdown', handle('admin/shutdown', async (c) => {
+  console.log('[admin] shutdown requested via API');
+  setTimeout(() => {
+    try {
+      sqlite.pragma('wal_checkpoint(TRUNCATE)');
+      sqlite.close();
+      console.log('[admin] database closed cleanly, exiting');
+    } catch (e) {
+      console.error('[admin] error during shutdown:', e);
+    }
+    process.exit(0);
+  }, 100);
+  return c.json({ ok: true, message: 'shutting down' });
+}));
+
 export default admin;