diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
new file mode 100644
index 00000000..94788615
--- /dev/null
+++ b/.gitea/workflows/deploy.yml
@@ -0,0 +1,49 @@
+name: Deploy to Staging
+
+# Triggered on every push to main (after PR merge).
+# Runs ONLY the deploy job — not tests — so the server
+# always reflects the latest main without waiting for the
+# full CI suite to finish. The existing ci.yml handles lint/tests.
+on:
+  push:
+    branches: [main]
+
+concurrency:
+  group: deploy-backend
+  cancel-in-progress: true
+
+jobs:
+  deploy:
+    name: Deploy backend + frontend to staging
+    runs-on: self-hosted
+
+    steps:
+      - name: Pull latest code
+        run: |
+          cd /opt/encoach/encoach_backend_new_v2
+          git fetch origin
+          git reset --hard origin/main
+          echo "Now at: $(git log -1 --oneline)"
+
+      - name: Rebuild and restart containers
+        run: |
+          cd /opt/encoach/encoach_backend_new_v2
+          docker compose \
+            -f docker-compose.yml \
+            -f /opt/encoach/overrides/encoach.override.yml \
+            up -d --build --remove-orphans
+          echo "Containers after deploy:"
+          docker ps --format "table {{.Names}}\t{{.Status}}" | grep -E "encoach-v4|encoach-frontend"
+
+      - name: Smoke test
+        run: |
+          echo "Waiting 20s for Odoo to settle..."
+          sleep 20
+          STATUS=$(curl -s -o /dev/null -w "%{http_code}" http://localhost:8069/api/health)
+          echo "/api/health => HTTP $STATUS"
+          if [ "$STATUS" != "200" ]; then
+            echo "WARNING: /api/health returned $STATUS (Odoo may still be starting)"
+          fi
+          FE=$(curl -s -o /dev/null -w "%{http_code}" http://localhost:3000/)
+          echo "frontend / => HTTP $FE"
+          test "$FE" = "200" || exit 1