diff --git a/services/FilterLists.AppHost/FilterLists.AppHost.csproj b/services/FilterLists.AppHost/FilterLists.AppHost.csproj
index 6c19331f3..9ef25c2e6 100644
--- a/services/FilterLists.AppHost/FilterLists.AppHost.csproj
+++ b/services/FilterLists.AppHost/FilterLists.AppHost.csproj
@@ -17,6 +17,7 @@
     <ItemGroup>
         <PackageReference Include="Aspire.Hosting.AppHost" Version="8.0.1"/>
         <PackageReference Include="Aspire.Hosting.Azure.ApplicationInsights" Version="8.0.1"/>
+        <PackageReference Include="Aspire.Hosting.SqlServer" Version="8.0.1"/>
     </ItemGroup>
 
 </Project>
diff --git a/services/FilterLists.AppHost/Program.cs b/services/FilterLists.AppHost/Program.cs
index 78f6dceae..6b0b9b1ed 100644
--- a/services/FilterLists.AppHost/Program.cs
+++ b/services/FilterLists.AppHost/Program.cs
@@ -4,7 +4,13 @@
 
 var appInsights = builder.AddAzureApplicationInsights("appinsights");
 
+// TODO: use separate users (db_ddladmin only for migrations) https://stackoverflow.com/q/78564037/2343739
+var directoryDb = builder.AddSqlServer("directorysqlserver")
+    .PublishAsConnectionString() // customized for free tier, don't trust Aspire to provision db
+    .AddDatabase("directorydb");
+
 var directoryApi = builder.AddProject<FilterLists_Directory_Api>("directoryapi")
+    .WithReference(directoryDb)
     .WithReference(appInsights);
 
 builder.AddProject<FilterLists_Web>("web")