diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index bbb19cb7..a06fd82d 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -44,4 +44,35 @@ jobs:
           pnpm biome:lint
           pnpm typecheck
           pnpm test
-          echo "--- CI checks passed ---"
\ No newline at end of file
+          echo "--- CI checks passed ---"
+
+  deploy:
+    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    runs-on: shell
+    needs: check
+    steps:
+      - name: Build and deploy
+        run: |
+          set -e
+          WORK="$(mktemp -d /var/tmp/epicnext-deploy.XXXXXX)"
+          cleanup() { rm -rf "${WORK}"; }
+          trap cleanup EXIT
+
+          echo "--- Deploy (${WORK}) ---"
+          git clone --depth 50 \
+            /docker/gitea/gitea/git/repositories/remco/epicnext-cms.git \
+            "${WORK}"
+          cd "${WORK}"
+
+          REF="${{ gitea.sha }}"
+          git fetch --depth 50 origin "${REF}"
+          git checkout -f "${REF}"
+
+          export NODE_ENV=production
+          export SKIP_ENV_VALIDATION=1
+          pnpm install --frozen-lockfile
+          pnpm prisma:generate
+          pnpm build
+          pm2 restart next --update-env
+          pm2 save
+          echo "--- Deploy complete ---"