diff --git a/.forgejo/workflows/deploy.yml b/.forgejo/workflows/deploy.yml
index ba44516..bbd3b07 100644
--- a/.forgejo/workflows/deploy.yml
+++ b/.forgejo/workflows/deploy.yml
@@ -1,21 +1,22 @@
-name: Deploy to production
+name: Deploy server-up
 
 on:
   push:
     branches: [main]
+    tags: ['v*']
   workflow_dispatch:
 
 concurrency:
-  group: production-deploy
-  cancel-in-progress: false   # niet cancelen — laat lopende deploys afmaken
+  group: server-up-deploy
+  cancel-in-progress: false
 
 jobs:
   deploy:
-    runs-on: self-hosted       # host-mode op je app-server
-    timeout-minutes: 15
+    runs-on: self-hosted
+    timeout-minutes: 20
 
     env:
-      DEPLOY_DIR: /opt/myapp
+      DEPLOY_DIR: /opt/server-up
 
     steps:
       - name: Checkout
@@ -23,7 +24,22 @@ jobs:
         with:
           fetch-depth: 1
 
-      - name: Sync naar deploy-directory
+      - name: Bepaal versie
+        id: version
+        run: |
+          set -euo pipefail
+          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
+            VERSION="${GITHUB_REF_NAME}"
+            CHANNEL="release"
+          else
+            VERSION="dev-${GITHUB_SHA:0:8}"
+            CHANNEL="dev"
+          fi
+          echo "VERSION=${VERSION}" >> "$GITHUB_ENV"
+          echo "CHANNEL=${CHANNEL}" >> "$GITHUB_ENV"
+          echo "Deploying version: ${VERSION} (${CHANNEL})"
+
+      - name: Sync code naar deploy-directory
         run: |
           set -euo pipefail
           rsync -a --delete \
@@ -31,55 +47,47 @@ jobs:
             --exclude='.forgejo/' \
             ./ "$DEPLOY_DIR/"
 
-      - name: Schrijf .env vanuit secrets
+      - name: Schrijf VERSION-bestand
         working-directory: ${{ env.DEPLOY_DIR }}
-        env:
-          DATABASE_URL: ${{ secrets.DATABASE_URL }}
-          API_KEY: ${{ secrets.API_KEY }}
-          NODE_ENV: production
-        run: |
-          set -euo pipefail
-          umask 077
-          cat > .env <<EOF
-          DATABASE_URL=${DATABASE_URL}
-          API_KEY=${API_KEY}
-          NODE_ENV=${NODE_ENV}
-          EOF
+        run: echo "${VERSION}" > VERSION
 
       - name: Build image
         working-directory: ${{ env.DEPLOY_DIR }}
-        env:
-          GIT_SHA: ${{ github.sha }}
         run: |
-          set -euo pipefail
           docker compose build --pull
+          # Extra tags zodat 'latest' altijd op de laatste deploy wijst
+          docker tag "server-up:${VERSION}" server-up:latest
+          docker tag "server-up:${VERSION}" "server-up:${CHANNEL}"
 
-      - name: Deploy (zero-downtime waar mogelijk)
+      - name: Deploy
         working-directory: ${{ env.DEPLOY_DIR }}
-        env:
-          GIT_SHA: ${{ github.sha }}
         run: |
           set -euo pipefail
           docker compose up -d --remove-orphans
           docker compose ps
 
       - name: Wachten op healthcheck
-        working-directory: ${{ env.DEPLOY_DIR }}
         run: |
           set -euo pipefail
-          for i in {1..30}; do
-            status=$(docker compose ps --format json app | grep -o '"Health":"[^"]*"' || true)
+          for i in {1..40}; do
+            status=$(docker inspect --format '{{.State.Health.Status}}' server-up 2>/dev/null || echo "starting")
             echo "poll $i: $status"
-            if echo "$status" | grep -q '"Health":"healthy"'; then
-              echo "App is healthy"
+            if [ "$status" = "healthy" ]; then
+              echo "server-up is healthy als versie ${VERSION}"
               exit 0
             fi
-            sleep 2
+            sleep 3
           done
-          echo "App werd niet healthy in tijd — logs:"
-          docker compose logs --tail=200
+          echo "server-up werd niet healthy in tijd — logs:"
+          cd "$DEPLOY_DIR" && docker compose logs --tail=200
           exit 1
 
-      - name: Oude images opruimen
+      - name: Oude images opruimen (behoud laatste 5)
         if: success()
-        run: docker image prune -f
+        run: |
+          docker images server-up --format '{{.Tag}} {{.ID}}' \
+            | grep -vE '^(latest|release|dev) ' \
+            | tail -n +6 \
+            | awk '{print $2}' \
+            | xargs -r docker rmi -f || true
+          docker image prune -f
\ No newline at end of file