diff --git a/.gitea/workflows/deploy-prod.yaml b/.gitea/workflows/deploy-prod.yaml
new file mode 100644
index 0000000..4f4c695
--- /dev/null
+++ b/.gitea/workflows/deploy-prod.yaml
@@ -0,0 +1,23 @@
+name: Deploy Prod
+
+on:
+  pull_request:
+    branches:
+      - prod
+    types: [closed]
+
+jobs:
+  deploy-prod:
+    name: Deploy prod
+    runs-on: [prod]
+    needs: push
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+        with:
+            ref: prod
+      - name: deploy
+        env:
+          VPN_PASSWORD: ${{ secrets.VPN_PASSWORD }}
+          VPN_IPSEC_PSK: ${{ secrets.VPN_IPSEC_PSK }}
+        run: docker stack deploy --with-registry-auth -c ./.deploy/deploy-prod.yaml vpn