diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml
index 06d435a..c4a1732 100644
--- a/.gitea/workflows/build.yaml
+++ b/.gitea/workflows/build.yaml
@@ -65,3 +65,19 @@ jobs:
 
       - name: Push
         run: docker push --all-tags "$IMAGE"
+
+      # Redeploy on the Docker host. The key's forced command on the host
+      # only accepts allowlisted site names, so this can't run anything else.
+      # Skipped when DEPLOY_HOST isn't set.
+      - name: Deploy
+        if: ${{ vars.DEPLOY_HOST != '' }}
+        env:
+          DEPLOY_HOST: ${{ vars.DEPLOY_HOST }}
+          DEPLOY_KNOWN_HOSTS: ${{ vars.DEPLOY_KNOWN_HOSTS }}
+          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+        run: |
+          install -m 700 -d ~/.ssh
+          printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/deploy_key
+          chmod 600 ~/.ssh/deploy_key
+          printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > ~/.ssh/known_hosts
+          ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=yes "root@$DEPLOY_HOST" theoldfitz