diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
new file mode 100644
index 0000000..585c722
--- /dev/null
+++ b/.github/workflows/deploy.yml
@@ -0,0 +1,67 @@
+name: Deploy release
+
+on:
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: "Target environment"
+        required: true
+        type: choice
+        options:
+          - production
+
+env:
+  SERVER_IMAGE: ghcr.io/riotbyte-com/cv-generator-server
+  WORKER_IMAGE: ghcr.io/riotbyte-com/cv-generator-worker
+
+jobs:
+  validate:
+    name: Validate release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check ref is a tag
+        run: |
+          if [[ "${{ github.ref_type }}" != "tag" ]]; then
+            echo "::error::Workflow must be run on a tag. Got ref: ${{ github.ref }}"
+            exit 1
+          fi
+
+      - name: Check container images exist
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          VERSION="${{ github.ref_name }}"
+          for pkg in cv-generator-server cv-generator-worker; do
+            gh api "/orgs/${{ github.repository_owner }}/packages/container/${pkg}/versions" \
+              --jq ".[] | select(.metadata.container.tags[] == \"${VERSION}\") | .id" \
+              | grep -q . \
+              || { echo "::error::No container image found for tag ${VERSION} at ghcr.io/${{ github.repository_owner }}/${pkg}"; exit 1; }
+          done
+
+  deploy:
+    name: Roll out to ${{ inputs.environment }}
+    needs: validate
+    runs-on: ubuntu-latest
+    environment: ${{ inputs.environment }}
+    steps:
+      - name: Configure kubeconfig
+        run: |
+          mkdir -p "$HOME/.kube"
+          echo "${{ secrets.KUBECONFIG }}" > "$HOME/.kube/config"
+          chmod 600 "$HOME/.kube/config"
+
+      - uses: azure/setup-kubectl@v4
+
+      - name: Update deployment images
+        run: |
+          VERSION="${{ github.ref_name }}"
+          kubectl -n "${{ vars.K8S_NAMESPACE }}" set image deployment/web \
+            migrate="${SERVER_IMAGE}:${VERSION}" \
+            web="${SERVER_IMAGE}:${VERSION}"
+          kubectl -n "${{ vars.K8S_NAMESPACE }}" set image deployment/worker \
+            worker="${WORKER_IMAGE}:${VERSION}"
+
+      - name: Wait for rollout
+        run: |
+          kubectl -n "${{ vars.K8S_NAMESPACE }}" rollout status deployment/web --timeout=5m
+          kubectl -n "${{ vars.K8S_NAMESPACE }}" rollout status deployment/worker --timeout=5m