diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
new file mode 100644
index 0000000..9533012
--- /dev/null
+++ b/.gitea/workflows/deploy.yml
@@ -0,0 +1,80 @@
+name: Deploy to IIS
+
+on:
+  push:
+    branches:
+      - main
+      - master
+  workflow_dispatch:
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    env:
+      LOCAL_PUBLISH: ${{ github.workspace }}/publish
+      MOUNT_POINT: /mnt/iis-deploy
+      SHARE: //10.0.0.148/wwwroot
+      TARGET_SUBDIR: approval_route
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '10.0.x'
+
+      - name: Restore
+        run: dotnet restore backend/Tnsu.ApprovalRoute.sln
+
+      - name: Publish (local)
+        run: dotnet publish backend/src/Tnsu.ApprovalRoute.Api/Tnsu.ApprovalRoute.Api.csproj -c Release -o "$LOCAL_PUBLISH"
+
+      - name: Install cifs-utils
+        run: sudo apt-get update && sudo apt-get install -y cifs-utils rsync
+
+      - name: Mount IIS share
+        env:
+          DEPLOY_CREDS_B64: ${{ secrets.DEPLOY_CREDS_B64 }}
+        run: |
+          echo "$DEPLOY_CREDS_B64" | base64 -d > /tmp/creds
+
+          chmod 600 /tmp/creds
+
+          echo "Credentials file created"
+
+          sudo mkdir -p "$MOUNT_POINT"
+
+          sudo mount -t cifs "$SHARE" "$MOUNT_POINT" \
+            -o credentials=/tmp/creds,vers=3.0,sec=ntlmssp,uid=$(id -u),gid=$(id -g),file_mode=0777,dir_mode=0777
+
+      - name: Take site offline
+        run: |
+          sudo mkdir -p "$MOUNT_POINT/$TARGET_SUBDIR"
+          echo "<h1>Deploying, please wait...</h1>" > "$MOUNT_POINT/$TARGET_SUBDIR/app_offline.htm"
+          sleep 20
+
+      - name: Sync files to IIS
+        run: |
+          rsync -a --delete \
+            --exclude 'app_offline.htm' \
+            --exclude 'logs/' \
+            --exclude 'inventory/' \
+            "$LOCAL_PUBLISH/" "$MOUNT_POINT/$TARGET_SUBDIR/"
+
+      - name: Bring site online
+        if: always()
+        run: |
+          rm -f "$MOUNT_POINT/$TARGET_SUBDIR/app_offline.htm" || true
+
+      - name: Unmount share
+        if: always()
+        run: |
+          sudo umount "$MOUNT_POINT" || true
+
+      - name: Final check
+        if: always()
+        run: |
+          echo "=== FINAL ==="
+          exit 0