diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index a804dea1..23b6b7ce 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -78,3 +78,42 @@ jobs:
         working-directory: frontend
       - run: pnpm exec playwright install --with-deps chromium && pnpm e2e
         working-directory: frontend
+
+  deploy:
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    needs: [static, backend, frontend]
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '10.0.x'
+
+      - name: Publish
+        run: |
+          dotnet restore KArtSell.sln
+          dotnet publish -c Release -o ./publish src/KArtSell.Host
+
+      - name: Deploy to production
+        env:
+          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
+          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
+          DEPLOY_KEY: ${{ secrets.DEPLOY_KEY }}
+        run: |
+          mkdir -p ~/.ssh
+          echo "$DEPLOY_KEY" > ~/.ssh/deploy_key
+          chmod 600 ~/.ssh/deploy_key
+          ssh-keyscan -H $DEPLOY_HOST >> ~/.ssh/known_hosts 2>/dev/null || true
+
+          # Copy published app
+          scp -i ~/.ssh/deploy_key -r ./publish/* $DEPLOY_USER@$DEPLOY_HOST:/app/kartsell/
+
+          # Restart service
+          ssh -i ~/.ssh/deploy_key $DEPLOY_USER@$DEPLOY_HOST "sudo systemctl restart kartsell"
+
+          # Health check
+          sleep 5
+          curl -f http://$DEPLOY_HOST:5002/health || echo "Health check pending"
+
+          rm ~/.ssh/deploy_key