diff --git a/.gitea/workflows/ci-cd.yml b/.gitea/workflows/ci-cd.yml
new file mode 100644
index 0000000..e7be4a7
--- /dev/null
+++ b/.gitea/workflows/ci-cd.yml
@@ -0,0 +1,46 @@
+name: CI/CD
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+
+# Pinned so every run targets the same project regardless of the runner's
+# checkout path — otherwise `docker compose` would derive the project name
+# from the checkout directory, potentially spinning up a second stack and
+# losing the `pgdata` volume instead of updating the running one.
+env:
+  COMPOSE_PROJECT_NAME: ruvdstests
+
+jobs:
+  build-test-deploy:
+    runs-on: host
+    steps:
+      - name: Checkout
+        uses: https://github.com/actions/checkout@v4
+
+      # The runner image ships bare (no Docker CLI, no .NET) — it only has
+      # the host's Docker *socket* mounted (DooD), so both are installed
+      # fresh each run rather than baking a custom runner image.
+      - name: Install Docker CLI and .NET SDK
+        shell: bash
+        run: |
+          apk add --no-cache docker-cli docker-cli-compose bash curl \
+            icu-libs krb5-libs libgcc libintl libssl3 libstdc++ zlib ca-certificates
+          curl -sSL https://dot.net/v1/dotnet-install.sh -o dotnet-install.sh
+          bash dotnet-install.sh --channel 9.0 --install-dir /usr/share/dotnet
+          ln -sf /usr/share/dotnet/dotnet /usr/local/bin/dotnet
+
+      - name: Run Domain unit tests
+        shell: bash
+        run: dotnet test tests/Domain.Tests/Domain.Tests.fsproj -c Release
+
+      - name: Build images
+        shell: bash
+        run: docker compose build
+
+      - name: Deploy (master only)
+        if: github.ref == 'refs/heads/master'
+        shell: bash
+        run: docker compose up -d