diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
new file mode 100644
index 0000000..33cff08
--- /dev/null
+++ b/.gitea/workflows/ci.yaml
@@ -0,0 +1,33 @@
+name: unbound-site
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    env:
+      BUILDTOOLS_CONTENT: ${{ secrets.BUILDTOOLS_CONTENT }}
+      GITEA_REPOSITORY: ${{ gitea.repository }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: buildtool/setup-buildtools-action@v1
+      - name: Build and push
+        run: unset GITEA_TOKEN && build && push
+
+  deploy-prod:
+    needs: build
+    if: gitea.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    env:
+      BUILDTOOLS_CONTENT: ${{ secrets.BUILDTOOLS_CONTENT }}
+      GITEA_REPOSITORY: ${{ gitea.repository }}
+    environment: prod
+    steps:
+      - uses: actions/checkout@v4
+      - uses: buildtool/setup-buildtools-action@v1
+      - name: Deploy to production
+        run: deploy prod
diff --git a/k8s/deploy.yaml b/k8s/deploy.yaml
index 1017f78..cf395e5 100644
--- a/k8s/deploy.yaml
+++ b/k8s/deploy.yaml
@@ -44,7 +44,7 @@ spec:
           periodSeconds: 5
           timeoutSeconds: 5
         imagePullPolicy: Always
-        image: registry.gitlab.com/unboundsoftware/unbound-site:${COMMIT}
+        image: oci.unbound.se/unboundsoftware/unbound-site:${COMMIT}
         ports:
         - containerPort: 80
         resources: