diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index de9c175..d5dbb09 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -1,37 +1,116 @@
-name: Rust CI
+name: Kolo Backend CI
 
-on: [push, pull_request]
+permissions:
+  contents: read
+
+on:
+  push:
+    branches: [ "main", "develop" ]
+  pull_request:
+    branches: [ "main", "develop" ]
 
 env:
   CARGO_TERM_COLOR: always
+  WORKING_DIR: contracts
 
 jobs:
   build-and-test:
-    name: Build & Test Soroban Contract
+    name: Build & Test
     runs-on: ubuntu-latest
     defaults:
       run:
-        working-directory: contracts
+        working-directory: ${{ env.WORKING_DIR }}
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+          targets: wasm32-unknown-unknown
       - name: Install Rust and wasm32 target
         run: |
           rustup toolchain install stable --profile minimal
           rustup default stable
           rustup target add wasm32v1-none
 
-      - name: Install system dependencies for Soroban CLI
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y libdbus-1-dev libudev-dev pkg-config
+      - name: Cache Cargo dependencies
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: ${{ env.WORKING_DIR }}
+
+      - name: Check formatting
+        run: cargo fmt --all -- --check
+
+      - name: Lint with Clippy
+        run: cargo clippy --all-targets --all-features -- -D warnings
+
+      - name: Build (native)
+        run: cargo build
+
+      - name: Run tests
+        run: cargo test --verbose
+
+      - name: Build WebAssembly (release)
+        run: cargo build --target wasm32-unknown-unknown --release
+
+      - name: Upload WASM artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: kolo-savings-group-wasm
+          path: ${{ env.WORKING_DIR }}/target/wasm32-unknown-unknown/release/kolo_savings_group.wasm
+          retention-days: 14
+
+  deploy:
+    name: Deploy to Testnet
+    runs-on: ubuntu-latest
+    needs: build-and-test
+    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    defaults:
+      run:
+        working-directory: ${{ env.WORKING_DIR }}
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
-      - name: Install Soroban CLI
-        run: cargo install --locked soroban-cli
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: wasm32-unknown-unknown
 
-      - name: Run unit tests
-        run: cargo test
+      - name: Cache Cargo dependencies
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: ${{ env.WORKING_DIR }}
 
+      - name: Install Stellar CLI
+        run: |
+          cargo install stellar-cli --locked
+          stellar --version
+
+      - name: Build and optimize WASM
+        run: |
+          RUSTFLAGS="-C target-cpu=mvp" cargo build \
+            --target wasm32-unknown-unknown \
+            --release
+          cargo install wasm-opt --locked
+          wasm-opt \
+            target/wasm32-unknown-unknown/release/kolo_savings_group.wasm \
+            -o target/wasm32-unknown-unknown/release/kolo_savings_group.optimized.wasm
+
+      - name: Deploy contract to testnet
+        env:
+          STELLAR_SOURCE_ACCOUNT: ${{ secrets.STELLAR_DEPLOYER_KEY }}
+        run: |
+          stellar contract deploy \
+            --wasm target/wasm32-unknown-unknown/release/kolo_savings_group.optimized.wasm \
+            --source-account "$STELLAR_SOURCE_ACCOUNT" \
+            --network testnet
       - name: Build contract for wasm (release)
         run: cargo build --target wasm32v1-none --release