diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 8ad9366..e8dfd91 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -7,9 +7,9 @@ on:
     branches: [main]
 
 jobs:
-  build:
-    name: Build
-    runs-on: ubuntu-latest
+  build-and-deploy:
+    name: Build & Deploy
+    runs-on: vps-runner
     steps:
       - uses: actions/checkout@v4
 
@@ -21,31 +21,36 @@ jobs:
             backend/package-lock.json
             frontend/package-lock.json
 
+      # ── Backend ──────────────────────────────────────────────────────────────
       - name: Install & build backend
         working-directory: backend
         run: |
           npm ci
           npm run build
 
+      - name: Deploy backend
+        run: |
+          mkdir -p /var/www/originsdigital/backend
+          rsync -a --delete backend/dist/ /var/www/originsdigital/backend/dist/
+          rsync -a backend/package.json backend/package-lock.json /var/www/originsdigital/backend/
+          cd /var/www/originsdigital/backend && npm ci --omit=dev
+
+      - name: Restart pm2
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        run: pm2 restart originsdigital-backend || pm2 start /var/www/originsdigital/backend/dist/index.js --name originsdigital-backend
+
+      # ── Frontend ─────────────────────────────────────────────────────────────
       - name: Install & build frontend
         working-directory: frontend
+        env:
+          VITE_API_URL: ${{ secrets.VITE_API_URL }}
+          VITE_SUPEROAUTH_URL: ${{ secrets.VITE_SUPEROAUTH_URL }}
         run: |
           npm ci
           npm run build
 
-  deploy:
-    name: Deploy to VPS
-    runs-on: ubuntu-latest
-    needs: build
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-    steps:
-      - name: Deploy via SSH
-        uses: appleboy/ssh-action@v1
-        with:
-          host: ${{ secrets.SSH_HOST }}
-          username: ${{ secrets.SSH_USER }}
-          key: ${{ secrets.SSH_PRIVATE_KEY }}
-          script: |
-            cd /home/tetardtek/github/originsdigital
-            git pull origin main
-            docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d --build
+      - name: Deploy frontend
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        run: |
+          mkdir -p /var/www/originsdigital/frontend/dist
+          rsync -a --delete frontend/dist/ /var/www/originsdigital/frontend/dist/