diff --git a/.gitea/workflows/deploy-backoffice.yml b/.gitea/workflows/deploy-backoffice.yml
new file mode 100644
index 0000000..c795ed7
--- /dev/null
+++ b/.gitea/workflows/deploy-backoffice.yml
@@ -0,0 +1,55 @@
+name: Deploy backoffice (smb-crm)
+
+# Manual only, on purpose: this runner has docker-compose access on the
+# homelab host, so triggering it is equivalent to a deploy. Only Gitea users
+# with write access to this repo can see/press the "Run workflow" button —
+# that's the access boundary, so keep collaborator roles deliberate as more
+# people join (see TODO.md).
+on:
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: "Branch/tag/commit to deploy"
+        required: false
+        default: "main"
+
+jobs:
+  deploy:
+    runs-on: [self-hosted, homelab]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref }}
+
+      # Only db/ and app/ — never touch secrets/ or .env, which live only on
+      # the host and aren't in the repo.
+      - name: Sync backoffice files
+        run: |
+          set -euo pipefail
+          rsync -a --delete backoffice/db/  /home/mivanchenko/smb-crm/db/
+          rsync -a --delete backoffice/app/ /home/mivanchenko/smb-crm/app/
+
+      # init.sql is all CREATE ... IF NOT EXISTS, so re-running it against the
+      # live DB on every deploy is safe and needs no separate migration tool.
+      - name: Apply pending schema changes
+        run: docker exec -i smb-db psql -U smbcrm -d smbcrm < backoffice/db/init.sql
+
+      - name: Build and restart smb-crm
+        run: |
+          cd /home/mivanchenko/smb-crm
+          docker compose build smb-crm
+          docker compose up -d --no-deps smb-crm
+
+      - name: Health check
+        run: |
+          set -euo pipefail
+          for i in $(seq 1 10); do
+            if docker exec smb-crm python3 -c "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://localhost:8080/healthz').status==200 else 1)"; then
+              echo "smb-crm healthy"
+              exit 0
+            fi
+            sleep 2
+          done
+          echo "smb-crm failed health check after deploy" >&2
+          exit 1