diff --git a/.forgejo/workflows/deploy-prod.yml b/.forgejo/workflows/deploy-prod.yml
new file mode 100644
index 0000000..8ac5a12
--- /dev/null
+++ b/.forgejo/workflows/deploy-prod.yml
@@ -0,0 +1,93 @@
+name: Deploy server-up (prod)
+
+on:
+  push:
+    branches: [main]
+    tags: ['v*']
+  workflow_dispatch:
+
+concurrency:
+  group: server-up-deploy-prod
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    runs-on: [self-hosted, prod]
+    timeout-minutes: 20
+
+    env:
+      DEPLOY_DIR: /opt/server-up
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Bepaal versie
+        id: version
+        run: |
+          set -euo pipefail
+          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
+            VERSION="${GITHUB_REF_NAME}"
+            CHANNEL="release"
+          else
+            VERSION="main-${GITHUB_SHA:0:8}"
+            CHANNEL="main"
+          fi
+          echo "VERSION=${VERSION}" >> "$GITHUB_ENV"
+          echo "CHANNEL=${CHANNEL}" >> "$GITHUB_ENV"
+          echo "SU_VERSION=${VERSION}" >> "$GITHUB_ENV"
+          echo "Deploying version: ${VERSION} (${CHANNEL})"
+
+      - name: Sync code naar deploy-directory
+        run: |
+          set -euo pipefail
+          rsync -a --delete \
+            --exclude='.git/' \
+            --exclude='.forgejo/' \
+            ./ "$DEPLOY_DIR/"
+
+      - name: Schrijf VERSION-bestand
+        working-directory: ${{ env.DEPLOY_DIR }}
+        run: echo "${VERSION}" > VERSION
+
+      - name: Build image
+        working-directory: ${{ env.DEPLOY_DIR }}
+        run: |
+          docker compose build --pull
+          docker tag "server-up:${VERSION}" server-up:latest
+          docker tag "server-up:${VERSION}" "server-up:${CHANNEL}"
+
+      - name: Deploy
+        working-directory: ${{ env.DEPLOY_DIR }}
+        run: |
+          set -euo pipefail
+          docker compose up -d --remove-orphans
+          docker compose ps
+
+      - name: Wachten op healthcheck
+        run: |
+          set -euo pipefail
+          for i in {1..40}; do
+            status=$(docker inspect --format '{{.State.Health.Status}}' server-up 2>/dev/null || echo "starting")
+            echo "poll $i: $status"
+            if [ "$status" = "healthy" ]; then
+              echo "server-up is healthy als versie ${VERSION}"
+              exit 0
+            fi
+            sleep 3
+          done
+          echo "server-up werd niet healthy in tijd — logs:"
+          cd "$DEPLOY_DIR" && docker compose logs --tail=200
+          exit 1
+
+      - name: Oude images opruimen (behoud laatste 5)
+        if: success()
+        run: |
+          docker images server-up --format '{{.Tag}} {{.ID}}' \
+            | grep -vE '^(latest|release|main) ' \
+            | tail -n +6 \
+            | awk '{print $2}' \
+            | xargs -r docker rmi -f || true
+          docker image prune -f
diff --git a/.forgejo/workflows/deploy.yml b/.forgejo/workflows/deploy.yml
index bbd3b07..4f1c0ff 100644
--- a/.forgejo/workflows/deploy.yml
+++ b/.forgejo/workflows/deploy.yml
@@ -1,18 +1,17 @@
-name: Deploy server-up
+name: Deploy server-up (dev)
 
 on:
   push:
-    branches: [main]
-    tags: ['v*']
+    branches: [dev]
   workflow_dispatch:
 
 concurrency:
-  group: server-up-deploy
+  group: server-up-deploy-dev
   cancel-in-progress: false
 
 jobs:
   deploy:
-    runs-on: self-hosted
+    runs-on: [self-hosted, dev]
     timeout-minutes: 20
 
     env:
@@ -37,6 +36,8 @@ jobs:
           fi
           echo "VERSION=${VERSION}" >> "$GITHUB_ENV"
           echo "CHANNEL=${CHANNEL}" >> "$GITHUB_ENV"
+          # SU_VERSION wordt door docker compose gebruikt als build-arg
+          echo "SU_VERSION=${VERSION}" >> "$GITHUB_ENV"
           echo "Deploying version: ${VERSION} (${CHANNEL})"
 
       - name: Sync code naar deploy-directory