diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index a6dce85..54d7d3c 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -6,6 +6,10 @@ on:
   pull_request:
     branches: [main]
 
+env:
+  DEPLOY_HOST: "10.10.1.82"
+  DEPLOY_PORT: "3010"
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -25,6 +29,40 @@ jobs:
       - name: Build
         run: bun run build
         env:
-          PORT: "3010"
-          # Build-time env (VITE_* for client; POCKETBASE_URL has fallback in code)
+          PORT: ${{ env.DEPLOY_PORT }}
           VITE_POCKETBASE_URL: ${{ vars.VITE_POCKETBASE_URL || 'https://pocketbase.ccllc.pro' }}
+
+      - name: Upload build artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: app
+          path: |
+            build
+            package.json
+            bun.lockb
+
+  deploy:
+    needs: build
+    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download build artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: app
+
+      - name: Install sshpass
+        run: sudo apt-get update -qq && sudo apt-get install -y sshpass
+
+      - name: Deploy to server
+        env:
+          DEPLOY_HOST: ${{ env.DEPLOY_HOST }}
+          DEPLOY_PORT: ${{ env.DEPLOY_PORT }}
+          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
+          DEPLOY_PASSWORD: ${{ secrets.DEPLOY_PASSWORD }}
+        run: |
+          set -e
+          ssh-keyscan -H $DEPLOY_HOST >> ~/.ssh/known_hosts 2>/dev/null || true
+          sshpass -p "$DEPLOY_PASSWORD" ssh -o StrictHostKeyChecking=accept-new $DEPLOY_USER@$DEPLOY_HOST "mkdir -p /var/www/hrm"
+          sshpass -p "$DEPLOY_PASSWORD" scp -o StrictHostKeyChecking=accept-new -r build package.json bun.lockb $DEPLOY_USER@$DEPLOY_HOST:/var/www/hrm/
+          sshpass -p "$DEPLOY_PASSWORD" ssh -o StrictHostKeyChecking=accept-new $DEPLOY_USER@$DEPLOY_HOST "cd /var/www/hrm && bun install --frozen-lockfile && pkill -f 'node build' || true; PORT=$DEPLOY_PORT nohup node build > /var/log/hrm.log 2>&1 &"
diff --git a/package.json b/package.json
index 0f2d6d4..55478e4 100644
--- a/package.json
+++ b/package.json
@@ -7,6 +7,7 @@
 		"dev": "vite dev",
 		"build": "vite build",
 		"preview": "vite preview",
+		"start": "node build",
 		"prepare": "svelte-kit sync || echo ''",
 		"check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
 		"check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch"