diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
new file mode 100644
index 00000000..0e7126f0
--- /dev/null
+++ b/.github/workflows/deploy.yml
@@ -0,0 +1,49 @@
+name: Deploy
+
+on:
+  push:
+    branches:
+      - release
+  workflow_dispatch:
+
+jobs:
+  deploy:
+    name: "Build and Deploy"
+    runs-on: codeberg-tiny
+    steps:
+      - name: "Checkout"
+        uses: actions/checkout@v4
+      - name: "Setup Go"
+        uses: actions/setup-go@v4
+        with:
+          go-version: 'stable'
+          check-latest: true
+      - name: "Setup pnpm"
+        uses: pnpm/action-setup@v4
+        with:
+          version: 'latest'
+      - name: "Setup Hugo"
+        uses: https://github.com/peaceiris/actions-hugo@v3
+        with:
+          hugo-version: '0.140.2'
+          extended: true
+      - name: "Hugo Build"
+        run: |
+          pnpm i
+          hugo --baseURL "${{ env.BASE_URL }}" -d "spec"
+      - name: Deploy to Remote
+        run: |
+          if [ ! -d ~/.ssh ]; then
+            mkdir -p ~/.ssh
+          fi
+          chmod 700 ~/.ssh
+          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          echo "${{ secrets.SSH_KNOWN_HOSTS }}" >> ~/.ssh/known_hosts
+          chmod 644 ~/.ssh/known_hosts
+          apt update && apt install rsync -y
+          rsync -av --delete -e "ssh -i ~/.ssh/id_ed25519 -o StrictHostKeyChecking=yes -p ${{ secrets.SSH_PORT }}" spec/ ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}:${{ secrets.WEB_ROOT }}/matrix-spec
+      - name: Clean up
+        run: |
+          rm -rf ~/.ssh
+          rm -rf spec