diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
new file mode 100644
index 0000000..28f556e
--- /dev/null
+++ b/.gitea/workflows/build.yml
@@ -0,0 +1,54 @@
+name: Build, Push and Deploy
+
+on:
+  push:
+    branches: [master, main, hotfix/*]
+
+env:
+  HARBOR: 192.168.31.213:10081
+  HARBOR_REGISTRY: 192.168.31.213:10081
+  HARBOR_PROJECT: wordcloud
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Login Harbor
+        run: |
+          echo "${{ secrets.HARBOR_PASS }}" | docker login "$HARBOR" \
+            -u "${{ secrets.HARBOR_USER }}" --password-stdin
+
+      - name: Build Docker images
+        run: |
+          if docker compose version >/dev/null 2>&1; then
+            COMPOSE="docker compose"
+          else
+            COMPOSE="docker-compose"
+          fi
+          $COMPOSE build
+
+      - name: Tag and push images
+        run: |
+          set -euo pipefail
+          SHA="${{ github.sha }}"
+          for name in wordcloud-backend wordcloud-frontend; do
+            image="$HARBOR/$HARBOR_PROJECT/$name"
+            docker tag "$image:latest" "$image:$SHA"
+            docker push "$image:latest"
+            docker push "$image:$SHA"
+          done
+
+  deploy:
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout deploy config
+        uses: actions/checkout@v4
+
+      - name: Deploy WordCloud
+        run: |
+          chmod +x ./deploy.sh
+          ./deploy.sh wordcloud production "${{ github.sha }}"
diff --git a/deploy.sh b/deploy.sh
new file mode 100755
index 0000000..0363a88
--- /dev/null
+++ b/deploy.sh
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+APP_NAME="${1:-wordcloud}"
+TARGET_ENV="${2:-production}"
+IMAGE_TAG="${3:-latest}"
+
+cd "$(dirname "$0")"
+
+if docker compose version >/dev/null 2>&1; then
+  COMPOSE="docker compose"
+else
+  COMPOSE="docker-compose"
+fi
+
+export COMPOSE_PROJECT_NAME="${APP_NAME}"
+export IMAGE_TAG
+
+echo "[deploy] project=${APP_NAME} env=${TARGET_ENV} image_tag=${IMAGE_TAG}"
+$COMPOSE pull
+$COMPOSE up -d --remove-orphans
+$COMPOSE ps
diff --git a/docker-compose.yml b/docker-compose.yml
index a7b649d..412df5d 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
   backend:
-    image: 114.55.99.6:10081/wordcloud/wordcloud-backend:latest
+    image: "${HARBOR_REGISTRY:-114.55.99.6:10081}/wordcloud/wordcloud-backend:${IMAGE_TAG:-latest}"
     build:
       context: ./backend
       dockerfile: Dockerfile
@@ -22,7 +22,7 @@ services:
       start_period: 60s
 
   frontend:
-    image: 114.55.99.6:10081/wordcloud/wordcloud-frontend:latest
+    image: "${HARBOR_REGISTRY:-114.55.99.6:10081}/wordcloud/wordcloud-frontend:${IMAGE_TAG:-latest}"
     build:
       context: ./frontend
       dockerfile: Dockerfile