diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
new file mode 100644
index 0000000..e30377f
--- /dev/null
+++ b/.gitea/workflows/ci.yaml
@@ -0,0 +1,39 @@
+name: geo-service
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    env:
+      BUILDTOOLS_CONTENT: ${{ secrets.BUILDTOOLS_CONTENT }}
+      GITEA_REPOSITORY: ${{ gitea.repository }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: buildtool/setup-buildtools-action@v1
+      - name: Show buildtools config
+        run: |
+          unset GITHUB_REPOSITORY_OWNER GITEA_TOKEN
+          build --config
+      - name: Build and push
+        run: |
+          unset GITHUB_REPOSITORY_OWNER GITEA_TOKEN
+          build --verbose --no-login && push --verbose
+
+  deploy-prod:
+    needs: build
+    if: gitea.ref == 'refs/heads/master'
+    runs-on: ubuntu-latest
+    env:
+      BUILDTOOLS_CONTENT: ${{ secrets.BUILDTOOLS_CONTENT }}
+      GITEA_REPOSITORY: ${{ gitea.repository }}
+    environment: prod
+    steps:
+      - uses: actions/checkout@v4
+      - uses: buildtool/setup-buildtools-action@v1
+      - name: Deploy
+        run: deploy prod
diff --git a/build-tools-dockerfile b/build-tools-dockerfile
new file mode 100644
index 0000000..6d6239e
--- /dev/null
+++ b/build-tools-dockerfile
@@ -0,0 +1,10 @@
+FROM amd64/golang:1.25.5@sha256:ad03ba93327b8a6143b49373790b5d92c28067bdb814418509466122ee9c9e63 as builder
+WORKDIR /src
+COPY * ./
+RUN go get
+RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o geo-service .
+
+FROM scratch
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
+COPY --from=builder /src/geo-service /
+CMD ["/geo-service"]
diff --git a/k8s/deploy.yaml b/k8s/deploy.yaml
index b2f1335..e5b1b66 100644
--- a/k8s/deploy.yaml
+++ b/k8s/deploy.yaml
@@ -41,7 +41,7 @@ spec:
             requests:
               memory: "100Mi"
           imagePullPolicy: Always
-          image: registry.gitlab.com/unboundsoftware/dancefinder/geo-service:${COMMIT}
+          image: oci.unbound.se/unboundsoftware/dancefinder/geo-service:${COMMIT}
           ports:
             - containerPort: 80
               name: http