diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index a06fd82d..abddaa60 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -45,34 +45,3 @@ jobs:
           pnpm typecheck
           pnpm test
           echo "--- CI checks passed ---"
-
-  deploy:
-    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
-    runs-on: shell
-    needs: check
-    steps:
-      - name: Build and deploy
-        run: |
-          set -e
-          WORK="$(mktemp -d /var/tmp/epicnext-deploy.XXXXXX)"
-          cleanup() { rm -rf "${WORK}"; }
-          trap cleanup EXIT
-
-          echo "--- Deploy (${WORK}) ---"
-          git clone --depth 50 \
-            /docker/gitea/gitea/git/repositories/remco/epicnext-cms.git \
-            "${WORK}"
-          cd "${WORK}"
-
-          REF="${{ gitea.sha }}"
-          git fetch --depth 50 origin "${REF}"
-          git checkout -f "${REF}"
-
-          export NODE_ENV=production
-          export SKIP_ENV_VALIDATION=1
-          pnpm install --frozen-lockfile
-          pnpm prisma:generate
-          pnpm build
-          pm2 restart next --update-env
-          pm2 save
-          echo "--- Deploy complete ---"
diff --git a/src/lib/ci-workflow-contract.test.ts b/src/lib/ci-workflow-contract.test.ts
new file mode 100644
index 00000000..49e0841b
--- /dev/null
+++ b/src/lib/ci-workflow-contract.test.ts
@@ -0,0 +1,25 @@
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { describe, expect, it } from "vitest";
+
+describe("CI workflow", () => {
+	const workflow = readFileSync(
+		resolve(process.cwd(), ".gitea/workflows/ci.yaml"),
+		"utf8",
+	);
+
+	it("only runs check (lint/typecheck/test), not production deploy", () => {
+		expect(workflow).toContain("pnpm biome:lint");
+		expect(workflow).toContain("pnpm typecheck");
+		expect(workflow).toContain("pnpm test");
+		expect(workflow).not.toMatch(/\n\s*deploy:\s*\n/);
+		expect(workflow).not.toContain("pm2 restart");
+		expect(workflow).not.toContain("pm2 start");
+		expect(workflow).not.toContain("github.ref");
+	});
+
+	it("uses Gitea SHA for checkout", () => {
+		expect(workflow).toContain("gitea.sha");
+		expect(workflow).toContain("SKIP_ENV_VALIDATION=1");
+	});
+});