diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index fc25eed..eaf2d7f 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -5,14 +5,17 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
+  workflow_dispatch:
 
 env:
   DEPLOY_HOST: "10.10.1.82"
-  DEPLOY_PORT: "3010"
+  APP_PORT: "3010"
+  DEPLOY_PATH: "/var/www/hrm"
 
 jobs:
   build:
     runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
     container:
       image: oven/bun:1
     steps:
@@ -22,47 +25,61 @@ jobs:
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
-      # Type check disabled until bits-ui/shadcn component types are fixed (run locally: bun run check)
-      # - name: Type check
-      #   run: bun run check
+      - name: Build
+        run: bun run build
+        env:
+          PORT: ${{ env.APP_PORT }}
+          VITE_POCKETBASE_URL: ${{ vars.VITE_POCKETBASE_URL || 'https://pocketbase.ccllc.pro' }}
+
+  deploy:
+    runs-on: ubuntu-latest
+    if: github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install Bun
+        run: |
+          curl -fsSL https://bun.sh/install | bash
+          echo "$HOME/.bun/bin" >> $GITHUB_PATH
+          echo "PATH=$HOME/.bun/bin:$PATH" >> $GITHUB_ENV
+
+      - name: Install deploy tools
+        run: sudo apt-get update -qq && sudo apt-get install -y rsync openssh-client sshpass
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
 
       - name: Build
         run: bun run build
         env:
-          PORT: ${{ env.DEPLOY_PORT }}
-          VITE_POCKETBASE_URL: ${{ vars.VITE_POCKETBASE_URL || 'https://pocketbase.ccllc.pro' }}
+          PORT: ${{ env.APP_PORT }}
+          VITE_POCKETBASE_URL: ${{ secrets.VITE_POCKETBASE_URL || vars.VITE_POCKETBASE_URL || 'https://pocketbase.ccllc.pro' }}
 
-      - name: Upload build artifact
-        uses: actions/upload-artifact@v3
-        with:
-          name: app
-          path: |
-            build
-            package.json
-            bun.lockb
-
-  deploy:
-    needs: build
-    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
-    runs-on: ubuntu-latest
-    steps:
-      - name: Download build artifact
-        uses: actions/download-artifact@v3
-        with:
-          name: app
-
-      - name: Install sshpass
-        run: sudo apt-get update -qq && sudo apt-get install -y sshpass
-
-      - name: Deploy to server
-        env:
-          DEPLOY_HOST: ${{ env.DEPLOY_HOST }}
-          DEPLOY_PORT: ${{ env.DEPLOY_PORT }}
-          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
-          DEPLOY_PASSWORD: ${{ secrets.DEPLOY_PASSWORD }}
+      - name: Prepare deploy artifact
         run: |
-          set -e
-          ssh-keyscan -H $DEPLOY_HOST >> ~/.ssh/known_hosts 2>/dev/null || true
-          sshpass -p "$DEPLOY_PASSWORD" ssh -o StrictHostKeyChecking=accept-new $DEPLOY_USER@$DEPLOY_HOST "mkdir -p /var/www/hrm"
-          sshpass -p "$DEPLOY_PASSWORD" scp -o StrictHostKeyChecking=accept-new -r build package.json bun.lockb $DEPLOY_USER@$DEPLOY_HOST:/var/www/hrm/
-          sshpass -p "$DEPLOY_PASSWORD" ssh -o StrictHostKeyChecking=accept-new $DEPLOY_USER@$DEPLOY_HOST "cd /var/www/hrm && bun install --frozen-lockfile && pkill -f 'node build' || true; PORT=$DEPLOY_PORT nohup node build > /var/log/hrm.log 2>&1 &"
+          mkdir -p deploy
+          cp -r build package.json bun.lockb deploy/
+          cd deploy && bun install --frozen-lockfile --production
+
+      - name: Setup SSH known hosts
+        run: |
+          mkdir -p ~/.ssh
+          ssh-keyscan -p ${{ secrets.DEPLOY_SSH_PORT || '22' }} -H ${{ secrets.DEPLOY_HOST || env.DEPLOY_HOST }} >> ~/.ssh/known_hosts 2>/dev/null || true
+
+      - name: Deploy via rsync
+        env:
+          SSH_PASSWORD: ${{ secrets.DEPLOY_PASSWORD }}
+        run: |
+          sshpass -p "$SSH_PASSWORD" rsync -avz --delete \
+            -e "ssh -o StrictHostKeyChecking=accept-new -p ${{ secrets.DEPLOY_SSH_PORT || '22' }}" \
+            deploy/ \
+            ${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST || env.DEPLOY_HOST }}:${{ secrets.DEPLOY_PATH || env.DEPLOY_PATH }}/
+
+      - name: Restart app on server
+        env:
+          SSH_PASSWORD: ${{ secrets.DEPLOY_PASSWORD }}
+        run: |
+          sshpass -p "$SSH_PASSWORD" ssh -o StrictHostKeyChecking=accept-new -p ${{ secrets.DEPLOY_SSH_PORT || '22' }} \
+            ${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST || env.DEPLOY_HOST }} \
+            "cd ${{ secrets.DEPLOY_PATH || env.DEPLOY_PATH }} && export PORT=${{ env.APP_PORT }} && (command -v pm2 &>/dev/null && (pm2 restart hrm 2>/dev/null || pm2 start build/index.js --name hrm) || true) || (sudo systemctl restart hrm 2>/dev/null) || (nohup node build > /var/log/hrm.log 2>&1 &)"
\ No newline at end of file