diff --git a/services/web/scripts/verify_domains.mjs b/services/web/scripts/verify_domains.mjs
new file mode 100644
index 0000000000..abf968153a
--- /dev/null
+++ b/services/web/scripts/verify_domains.mjs
@@ -0,0 +1,14 @@
+import { scriptRunner } from './lib/ScriptRunner.mjs'
+import DomainVerificationCron from '../modules/group-settings/app/src/DomainVerificationCron.mjs'
+
+async function main() {
+  await DomainVerificationCron.promises.verifyAll()
+}
+
+try {
+  await scriptRunner(main)
+  process.exit(0)
+} catch (error) {
+  console.error(error)
+  process.exit(1)
+}
diff --git a/tools/migrations/20260520120000_add_domainVerifications_scheduler_index.mjs b/tools/migrations/20260520120000_add_domainVerifications_scheduler_index.mjs
new file mode 100644
index 0000000000..8b07a2931a
--- /dev/null
+++ b/tools/migrations/20260520120000_add_domainVerifications_scheduler_index.mjs
@@ -0,0 +1,31 @@
+/* eslint-disable no-unused-vars */
+
+import Helpers from './lib/helpers.mjs'
+
+const tags = ['saas', 'nonblocking']
+
+// Supports the daily scheduler query in scripts/verify_domains.mjs which
+// filters on status and lastVerificationAttemptAt.
+const indexes = [
+  {
+    key: { status: 1, lastVerificationAttemptAt: 1 },
+    name: 'status_1_lastVerificationAttemptAt_1',
+  },
+]
+
+const migrate = async client => {
+  const { db } = client
+
+  await Helpers.addIndexesToCollection(db.domainVerifications, indexes)
+}
+
+const rollback = async client => {
+  const { db } = client
+  await Helpers.dropIndexesFromCollection(db.domainVerifications, indexes)
+}
+
+export default {
+  tags,
+  migrate,
+  rollback,
+}