diff --git a/README.md b/README.md
index 864d6a8..17c1dfb 100644
--- a/README.md
+++ b/README.md
@@ -222,6 +222,8 @@ Defaults live in `config/config.yaml` and are merged under `golem15.user.*`. Any
 | `user:token:list` | List token metadata without secrets or hashes. |
 | `user:token:revoke <id>` | Revoke a shared API token immediately. |
 
+Each command uses the database the serve command published or, run from the console, opens one from `database.dsn` (and loads the encryption keys from `app.key`) for its duration.
+
 ## Dependencies
 
 - The SummerCMS framework, `git.golem15.com/golem15/summercms` (modules `backpack`, `bonfire`, `bouncer`, `pact`, `party`, `surf` and others).
diff --git a/console/backfill_handles.go b/console/backfill_handles.go
index 9ab3321..27f49a0 100644
--- a/console/backfill_handles.go
+++ b/console/backfill_handles.go
@@ -8,10 +8,14 @@ import (
 	"git.golem15.com/golem15/sm-user-plugin/models"
 	"git.golem15.com/golem15/summercms/modules/backpack"
 	"git.golem15.com/golem15/summercms/modules/bonfire"
+	"git.golem15.com/golem15/summercms/modules/lagoon"
 	"gorm.io/gorm"
 )
 
 // BackfillHandles fills a unique handle on every user row that still has none.
+// It uses the database the serve command published or, when it runs as a
+// console command, opens one from the config for the duration of the run,
+// as the plugin's other commands do.
 func BackfillHandles(app *backpack.App) bonfire.Command {
 	return bonfire.Command{
 		Name:        "user:backfill-handles",
@@ -22,7 +26,12 @@ func BackfillHandles(app *backpack.App) bonfire.Command {
 			}
 			gdb, ok := app.Lookup[*gorm.DB]()
 			if !ok || gdb == nil {
-				return fmt.Errorf("user:backfill-handles: database is not configured")
+				sqlDB, opened, err := lagoon.OpenFromApp(ctx, app)
+				if err != nil {
+					return fmt.Errorf("user:backfill-handles: %w", err)
+				}
+				defer sqlDB.Close()
+				gdb = opened
 			}
 			var users []models.User
 			if err := gdb.WithContext(ctx).Where("handle IS NULL OR handle = ''").Find(&users).Error; err != nil {
diff --git a/console_test.go b/console_test.go
index 53454ca..3da3563 100644
--- a/console_test.go
+++ b/console_test.go
@@ -3,6 +3,7 @@ package user
 import (
 	"bytes"
 	"context"
+	"encoding/base64"
 	"strings"
 	"testing"
 
@@ -77,6 +78,40 @@ func TestConsoleWithDBOpensFromConfigWhenUnpublished(t *testing.T) {
 	}
 }
 
+// TestBackfillHandlesOpensFromConfigWhenUnpublished runs user:backfill-handles
+// as the console does: no published database, only database.dsn in the config.
+func TestBackfillHandlesOpensFromConfigWhenUnpublished(t *testing.T) {
+	_, gdb := sessionApp(t, "0s")
+	user := insertUser(t, gdb, "backfill-unpublished@example.test", "correct-horse")
+	if err := gdb.Model(user).Update("handle", nil).Error; err != nil {
+		t.Fatal(err)
+	}
+	app := backpack.New(sessionConfig(t))
+	if err := app.Config.Set("database.dsn", sessionDSN); err != nil {
+		t.Fatal(err)
+	}
+	// Opening a database also loads the encryption keys from app.key.
+	if err := app.Config.Set("app.key", base64.StdEncoding.EncodeToString([]byte("0123456789abcdef0123456789abcdef"))); err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := app.Lookup[*gorm.DB](); ok {
+		t.Fatal("setup: a database is published")
+	}
+	cmd := commandNamed(t, (&Plugin{app: app}).Commands(), "user:backfill-handles")
+	var buf bytes.Buffer
+	out := bonfire.NewOutput(nil, &buf, &buf)
+	if err := cmd.Run(context.Background(), emailArg{}, out); err != nil {
+		t.Fatalf("run: %v (output %q)", err, buf.String())
+	}
+	var fresh models.User
+	if err := gdb.First(&fresh, user.ID).Error; err != nil {
+		t.Fatal(err)
+	}
+	if fresh.Handle == nil || *fresh.Handle == "" {
+		t.Fatal("the user still has no handle")
+	}
+}
+
 func commandNamed(t *testing.T, cmds []bonfire.Command, name string) bonfire.Command {
 	t.Helper()
 	for _, candidate := range cmds {