diff --git a/.forgejo/workflows/deploy.yml b/.forgejo/workflows/deploy.yml
new file mode 100644
index 0000000..ba44516
--- /dev/null
+++ b/.forgejo/workflows/deploy.yml
@@ -0,0 +1,85 @@
+name: Deploy to production
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: production-deploy
+  cancel-in-progress: false   # niet cancelen — laat lopende deploys afmaken
+
+jobs:
+  deploy:
+    runs-on: self-hosted       # host-mode op je app-server
+    timeout-minutes: 15
+
+    env:
+      DEPLOY_DIR: /opt/myapp
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Sync naar deploy-directory
+        run: |
+          set -euo pipefail
+          rsync -a --delete \
+            --exclude='.git/' \
+            --exclude='.forgejo/' \
+            ./ "$DEPLOY_DIR/"
+
+      - name: Schrijf .env vanuit secrets
+        working-directory: ${{ env.DEPLOY_DIR }}
+        env:
+          DATABASE_URL: ${{ secrets.DATABASE_URL }}
+          API_KEY: ${{ secrets.API_KEY }}
+          NODE_ENV: production
+        run: |
+          set -euo pipefail
+          umask 077
+          cat > .env <<EOF
+          DATABASE_URL=${DATABASE_URL}
+          API_KEY=${API_KEY}
+          NODE_ENV=${NODE_ENV}
+          EOF
+
+      - name: Build image
+        working-directory: ${{ env.DEPLOY_DIR }}
+        env:
+          GIT_SHA: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          docker compose build --pull
+
+      - name: Deploy (zero-downtime waar mogelijk)
+        working-directory: ${{ env.DEPLOY_DIR }}
+        env:
+          GIT_SHA: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          docker compose up -d --remove-orphans
+          docker compose ps
+
+      - name: Wachten op healthcheck
+        working-directory: ${{ env.DEPLOY_DIR }}
+        run: |
+          set -euo pipefail
+          for i in {1..30}; do
+            status=$(docker compose ps --format json app | grep -o '"Health":"[^"]*"' || true)
+            echo "poll $i: $status"
+            if echo "$status" | grep -q '"Health":"healthy"'; then
+              echo "App is healthy"
+              exit 0
+            fi
+            sleep 2
+          done
+          echo "App werd niet healthy in tijd — logs:"
+          docker compose logs --tail=200
+          exit 1
+
+      - name: Oude images opruimen
+        if: success()
+        run: docker image prune -f