diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml
new file mode 100644
index 0000000..7937eee
--- /dev/null
+++ b/.gitea/workflows/deploy.yaml
@@ -0,0 +1,51 @@
+name: Deploy
+
+on:
+  push:
+    branches: [main]
+
+env:
+  REGISTRY: git.kimchi
+  IMAGE: git.kimchi/tas/major_tom
+  NAMESPACE: jnr-web
+  DEPLOYMENT: jnr-web
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      # ── Build WASM artifacts inside an Emscripten container ──
+      - name: Build WASM
+        uses: docker://emscripten/emsdk:3.1.51
+        with:
+          args: make web
+
+      # ── Build container image and push to Gitea registry ──
+      - name: Build and push container image
+        run: |
+          IMAGE_TAG="${{ env.IMAGE }}:sha-${GITHUB_SHA::8}"
+          IMAGE_LATEST="${{ env.IMAGE }}:latest"
+
+          docker build -f Containerfile -t "$IMAGE_TAG" -t "$IMAGE_LATEST" .
+          docker login "${{ env.REGISTRY }}" -u "${{ secrets.REGISTRY_USER }}" -p "${{ secrets.REGISTRY_PASSWORD }}"
+          docker push "$IMAGE_TAG"
+          docker push "$IMAGE_LATEST"
+
+          echo "IMAGE_TAG=$IMAGE_TAG" >> "$GITHUB_ENV"
+
+      # ── Deploy to k3s ──
+      - name: Deploy to k3s
+        run: |
+          mkdir -p ~/.kube
+          echo "${{ secrets.KUBECONFIG }}" > ~/.kube/config
+          chmod 600 ~/.kube/config
+
+          kubectl set image deployment/${{ env.DEPLOYMENT }} \
+            ${{ env.DEPLOYMENT }}="${{ env.IMAGE_TAG }}" \
+            -n ${{ env.NAMESPACE }}
+
+          kubectl rollout status deployment/${{ env.DEPLOYMENT }} \
+            -n ${{ env.NAMESPACE }} --timeout=60s