diff --git a/.forgejo/workflows/deploy.yml b/.forgejo/workflows/deploy.yml
new file mode 100644
index 0000000..86ff561
--- /dev/null
+++ b/.forgejo/workflows/deploy.yml
@@ -0,0 +1,39 @@
+name: Deploy krustyplanet.org
+on:
+  push:
+    branches: [main]
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    container:
+      image: node:22-bookworm
+      volumes:
+        - /home/agent/.ssh:/home/root/.ssh:ro
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install system dependencies
+        run: apt-get update && apt-get install -y rsync openssh-client
+
+      - name: Setup SSH
+        run: |
+          mkdir -p ~/.ssh
+          cp /home/root/.ssh/id_ed25519 ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          chmod 700 ~/.ssh
+          echo "5.161.214.55 ssh-ed25519 $(ssh-keyscan -t ed25519 5.161.214.55 2>/dev/null | awk '{print $3}')" > ~/.ssh/known_hosts
+
+      - name: Deploy to clearnet
+        run: |
+          rsync -avz --delete \
+            --exclude '.git' \
+            --exclude '.forgejo' \
+            --exclude 'terraform' \
+            --exclude 'research' \
+            --exclude 'scripts' \
+            ./ root@5.161.214.55:/var/www/krustyplanet/
+
+      - name: Sync eepsite
+        run: ssh root@5.161.214.55 'cd /var/www/krustyplanet && bash scripts/sync-eepsite.sh'