diff --git a/.forgejo/workflows/deploy.yml b/.forgejo/workflows/deploy.yml
new file mode 100644
index 0000000..7bbc68f
--- /dev/null
+++ b/.forgejo/workflows/deploy.yml
@@ -0,0 +1,29 @@
+name: Deploy
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      # The job container only sees its own checkout — the live app lives
+      # at /mnt/user/appdata/lunch-notifier on the host, bind-mounted into
+      # this container at the same path (see runner container.options) so
+      # `docker compose`'s relative volume paths resolve against the real
+      # host directory rather than an ephemeral one. `.env` and `data/`
+      # are server-only and must survive every deploy.
+      - name: Sync source to deploy path
+        run: |
+          rsync -a --delete \
+            --exclude='.git' \
+            --exclude='.env' \
+            --exclude='data' \
+            ./ /mnt/user/appdata/lunch-notifier/
+
+      - name: Rebuild and restart
+        working-directory: /mnt/user/appdata/lunch-notifier
+        run: docker compose up -d --build