diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
new file mode 100644
index 0000000..e92b472
--- /dev/null
+++ b/.github/workflows/deploy.yml
@@ -0,0 +1,53 @@
+name: deploy-staging
+
+on:
+    push:
+        tags:
+            - 'v[0-9]+.[0-9]+.[0-9]+'
+
+env:
+    IMAGE_NAME: productionbuild/analytodon-cli
+
+jobs:
+    build-and-push:
+        name: Build and push
+        runs-on: ubuntu-latest
+        permissions:
+            contents: read
+        steps:
+            - name: Checkout repository
+              uses: actions/checkout@v4
+            - name: Log in to container registry
+              uses: docker/login-action@v3
+              with:
+                  username: ${{ secrets.DOCKERHUB_USERNAME }}
+                  password: ${{ secrets.DOCKERHUB_PASSWORD }}
+            - name: 'Build and push'
+              uses: docker/build-push-action@v5
+              with:
+                  push: true
+                  tags: |
+                      ${{ env.IMAGE_NAME }}:latest
+                      ${{ env.IMAGE_NAME }}:${{ github.sha }}
+                      ${{ env.IMAGE_NAME }}:${{ github.ref_name }}
+    deploy:
+        name: Deploy
+        needs: build-and-push
+        runs-on: ubuntu-latest
+        steps:
+            - name: Install doctl
+              uses: digitalocean/action-doctl@v2
+              with:
+                  token: ${{ secrets.DIGITALOCEAN_ACCESS_TOKEN }}
+            - name: Save DigitalOcean kubeconfig with short-lived credentials
+              run: doctl kubernetes cluster kubeconfig save productionbuild-cluster
+            - name: Checkout source code
+              uses: actions/checkout@v4
+            - name: Deploy to the Kubernetes cluster
+              uses: azure/k8s-deploy@v4
+              with:
+                  namespace: analytodon
+                  manifests: |
+                      deploy/k8s/analytodon-cli.yml
+                  images: |
+                      ${{ env.IMAGE_NAME }}:${{ github.sha }}
diff --git a/deploy/k8s/analytodon-cli.yml b/deploy/k8s/analytodon-cli.yml
new file mode 100644
index 0000000..956abbf
--- /dev/null
+++ b/deploy/k8s/analytodon-cli.yml
@@ -0,0 +1,47 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+    name: analytodon-cli
+    namespace: analytodon
+spec:
+    replicas: 1
+    strategy:
+        type: Recreate
+    selector:
+        matchLabels:
+            app: analytodon-cli
+    template:
+        metadata:
+            labels:
+                app: analytodon-cli
+        spec:
+            affinity:
+                nodeAffinity:
+                    preferredDuringSchedulingIgnoredDuringExecution:
+                        - weight: 1
+                          preference:
+                              matchExpressions:
+                                  - key: project
+                                    operator: In
+                                    values:
+                                        - analytodon
+            containers:
+                - name: analytodon-cli
+                  image: productionbuild/analytodon-cli:latest
+                  imagePullPolicy: Always
+                  env:
+                      - name: NEWRELIC_LICENSE_KEY
+                        valueFrom:
+                            secretKeyRef:
+                                name: newrelic-secret
+                                key: license-key
+                      - name: MONGODB_URI
+                        valueFrom:
+                            secretKeyRef:
+                                name: mongodb-secret
+                                key: uri
+                      - name: EMAIL_API_KEY
+                        valueFrom:
+                            secretKeyRef:
+                                name: emailapi-secret
+                                key: key
diff --git a/deploy/k8s/namespace.yml b/deploy/k8s/namespace.yml
new file mode 100644
index 0000000..a2cc1a9
--- /dev/null
+++ b/deploy/k8s/namespace.yml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+    name: analytodon