diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
new file mode 100644
index 0000000..cdbbe66
--- /dev/null
+++ b/.gitea/workflows/deploy.yml
@@ -0,0 +1,41 @@
+name: deploy
+on:
+  workflow_dispatch:
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Show toolchain
+        run: node -v && npm -v
+
+      - name: Install deploy tools
+        run: |
+          apt-get update -qq
+          apt-get install -y -qq --no-install-recommends rsync openssh-client
+
+      - name: Configure SSH
+        env:
+          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+          MX_HOST_KEY: ${{ secrets.MX_HOST_KEY }}
+        run: |
+          install -m 700 -d ~/.ssh
+          printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/id_ed25519
+          printf '%s\n' "$MX_HOST_KEY" > ~/.ssh/known_hosts
+          chmod 600 ~/.ssh/id_ed25519 ~/.ssh/known_hosts
+
+      - name: Build
+        run: |
+          npm ci
+          npm run build
+
+      - name: Deploy
+        run: |
+          set -euo pipefail
+          REL="$(date -u +%Y%m%dT%H%M%SZ)-$(printf %s "$GITHUB_SHA" | cut -c1-7)"
+          rsync -a --exclude=.git \
+            --link-dest=/var/www/ponomar/current \
+            dist/ deploy@10.8.0.1:/var/www/ponomar/releases/"$REL"/
+          ssh deploy@10.8.0.1 "deploy-site ponomar $REL"