diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
new file mode 100644
index 0000000..bc37472
--- /dev/null
+++ b/.gitlab-ci.yml
@@ -0,0 +1,35 @@
+stages:
+  - build
+  - deploy
+
+variables:
+  DOCKER_TLS_CERTDIR: ""
+
+build:image:
+  stage: build
+  image: docker:27
+  services:
+    - name: docker:27-dind
+      command: ["--tls=false"]
+  rules:
+    - if: $CI_COMMIT_BRANCH
+  script:
+    - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" "$CI_REGISTRY"
+    - docker build -t "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHA" -t "$CI_REGISTRY_IMAGE:latest" .
+    - docker push "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHA"
+    - docker push "$CI_REGISTRY_IMAGE:latest"
+
+deploy:prod:
+  stage: deploy
+  image: alpine:3.20
+  needs: ["build:image"]
+  rules:
+    - if: $CI_COMMIT_BRANCH == "main"
+  before_script:
+    - apk add --no-cache openssh-client
+    - mkdir -p ~/.ssh
+    - echo "$DEPLOY_SSH_PRIVATE_KEY" | tr -d "\r" > ~/.ssh/id_rsa
+    - chmod 600 ~/.ssh/id_rsa
+    - ssh-keyscan -H "$DEPLOY_HOST" >> ~/.ssh/known_hosts
+  script:
+    - ssh "$DEPLOY_USER@$DEPLOY_HOST" "cd '$DEPLOY_PATH' && ./deploy/deploy.sh '$CI_REGISTRY_IMAGE' '$CI_COMMIT_SHA'"
diff --git a/deploy/deploy.sh b/deploy/deploy.sh
new file mode 100755
index 0000000..3e8e2d7
--- /dev/null
+++ b/deploy/deploy.sh
@@ -0,0 +1,21 @@
+#!/usr/bin/env sh
+set -eu
+
+IMAGE_REPO=${1:-""}
+IMAGE_TAG=${2:-"latest"}
+
+if [ -z "$IMAGE_REPO" ]; then
+  echo "usage: $0 <image_repo> <image_tag>" >&2
+  exit 2
+fi
+
+export IMAGE_REPO
+export IMAGE_TAG
+
+echo "Deploying $IMAGE_REPO:$IMAGE_TAG"
+
+docker compose pull realtime_voice || true
+docker compose up -d --force-recreate realtime_voice
+docker image prune -f >/dev/null 2>&1 || true
+
+echo "Done"
diff --git a/docker-compose.yml b/docker-compose.yml
index ebb370f..dbbe4d4 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,5 +1,6 @@
 services:
   realtime_voice:
+    image: ${IMAGE_REPO:-realtime_voice_service}:${IMAGE_TAG:-latest}
     build:
       context: .
       dockerfile: Dockerfile