diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
new file mode 100644
index 0000000..84e5480
--- /dev/null
+++ b/.gitea/workflows/deploy.yml
@@ -0,0 +1,61 @@
+name: Deploy TodoList
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - name: Verify runner prerequisites
+        shell: bash
+        run: |
+          set -Eeuo pipefail
+          command -v bash >/dev/null
+          command -v ssh >/dev/null
+          command -v base64 >/dev/null
+
+      - name: Deploy production
+        shell: bash
+        env:
+          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
+          DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
+          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
+          DEPLOY_SSH_KEY_B64: ${{ secrets.DEPLOY_SSH_KEY_B64 }}
+          DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
+        run: |
+          set -Eeuo pipefail
+          umask 077
+
+          test -n "$DEPLOY_HOST"
+          test -n "$DEPLOY_PORT"
+          test -n "$DEPLOY_USER"
+          test -n "$DEPLOY_SSH_KEY_B64"
+          test -n "$DEPLOY_KNOWN_HOSTS"
+
+          SSH_DIR="$(mktemp -d)"
+          trap 'rm -rf -- "$SSH_DIR"' EXIT HUP INT TERM
+
+          printf '%s' "$DEPLOY_SSH_KEY_B64" |
+            base64 --decode > "$SSH_DIR/id_ed25519"
+
+          printf '%s\n' "$DEPLOY_KNOWN_HOSTS" \
+            > "$SSH_DIR/known_hosts"
+
+          chmod 600 "$SSH_DIR/id_ed25519"
+          chmod 600 "$SSH_DIR/known_hosts"
+
+          ssh \
+            -p "$DEPLOY_PORT" \
+            -i "$SSH_DIR/id_ed25519" \
+            -o BatchMode=yes \
+            -o IdentitiesOnly=yes \
+            -o StrictHostKeyChecking=yes \
+            -o UserKnownHostsFile="$SSH_DIR/known_hosts" \
+            "$DEPLOY_USER@$DEPLOY_HOST" \
+            /home/scaiuser/dwh_apps/fastapi-todolist/scripts/ci-deploy-entrypoint.sh
diff --git a/scripts/ci-deploy-entrypoint.sh b/scripts/ci-deploy-entrypoint.sh
new file mode 100755
index 0000000..8b27a13
--- /dev/null
+++ b/scripts/ci-deploy-entrypoint.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+
+set -Eeuo pipefail
+umask 077
+
+EXPECTED_USER="scaiuser"
+PROJECT_DIR="/home/scaiuser/dwh_apps/fastapi-todolist"
+
+if [[ "$(id -un)" != "$EXPECTED_USER" ]]; then
+    echo "Error: deployment entrypoint must run as $EXPECTED_USER" >&2
+    exit 1
+fi
+
+export XDG_RUNTIME_DIR="/run/user/$(id -u)"
+export DBUS_SESSION_BUS_ADDRESS="unix:path=$XDG_RUNTIME_DIR/bus"
+
+if [[ ! -S "$XDG_RUNTIME_DIR/bus" ]]; then
+    echo "Error: user systemd bus is unavailable" >&2
+    exit 1
+fi
+
+cd "$PROJECT_DIR"
+exec ./scripts/release.sh