diff --git a/.github/workflows/deploy-production.yml b/.github/workflows/deploy-production.yml
new file mode 100644
index 00000000..6a660ee4
--- /dev/null
+++ b/.github/workflows/deploy-production.yml
@@ -0,0 +1,68 @@
+name: Deploy production
+
+on:
+  workflow_run:
+    workflows: ["Jyotish Skill CI"]
+    types: [completed]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: production
+  cancel-in-progress: false
+
+env:
+  DEPLOY_HOST: 103.117.123.53
+  DEPLOY_PORT: "22000"
+  DEPLOY_USER: root
+  DEPLOY_PATH: /opt/jyotisha-app
+
+jobs:
+  deploy:
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.workflow_run.conclusion == 'success' &&
+       github.event.workflow_run.event == 'push' &&
+       github.event.workflow_run.head_branch == 'main')
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+      - name: Checkout tested revision
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.workflow_run.head_sha || github.sha }}
+
+      - name: Configure SSH
+        env:
+          SSH_PRIVATE_KEY: ${{ secrets.PRODUCTION_SSH_PRIVATE_KEY }}
+        run: |
+          install -m 700 -d ~/.ssh
+          printf '%s\n' "$SSH_PRIVATE_KEY" > ~/.ssh/jyotisha-production
+          chmod 600 ~/.ssh/jyotisha-production
+          printf '%s\n' '[103.117.123.53]:22000 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHQJvN2Mo3Yq8e6ZIK4P2blJ5Vjj0HbknEuk7TyjhMbO' > ~/.ssh/known_hosts
+
+      - name: Sync and rebuild
+        run: |
+          RSYNC_SSH="ssh -i $HOME/.ssh/jyotisha-production -p $DEPLOY_PORT"
+          rsync -az --delete \
+            --exclude='.git/' \
+            --exclude='.env.production' \
+            --exclude='frontend/node_modules/' \
+            --exclude='frontend/.next/' \
+            --exclude='jyotish-app/node_modules/' \
+            --exclude='jyotish-app/dist/' \
+            -e "$RSYNC_SSH" \
+            ./ "$DEPLOY_USER@$DEPLOY_HOST:$DEPLOY_PATH/"
+
+          ssh -i ~/.ssh/jyotisha-production -p "$DEPLOY_PORT" "$DEPLOY_USER@$DEPLOY_HOST" \
+            "cd '$DEPLOY_PATH' && docker compose --env-file .env.production -f deploy/docker-compose.server.yml up -d --build --remove-orphans"
+
+      - name: Verify production
+        run: |
+          curl --fail --silent --show-error --retry 12 --retry-delay 5 https://jyotisha.chat/login >/dev/null
+          test "$(curl --silent --output /dev/null --write-out '%{http_code}' https://jyotisha.chat/api/account)" = "401"
+          ssh -i ~/.ssh/jyotisha-production -p "$DEPLOY_PORT" "$DEPLOY_USER@$DEPLOY_HOST" \
+            "cd '$DEPLOY_PATH' && docker compose --env-file .env.production -f deploy/docker-compose.server.yml exec -T web node -e 'fetch(\"http://api:5200/api/health\").then(async r => { const body = await r.json(); if (!r.ok || body.status !== \"ok\" || body.swisseph_available !== true) process.exit(1); console.log(JSON.stringify(body)); })'"
diff --git a/AGENTS.md b/AGENTS.md
index 2840ba4c..0469359f 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -22,6 +22,7 @@ Deployment safety rules:
 3. Keep Supabase Auth Site URL and redirect URLs aligned with `https://jyotisha.chat`.
 4. After deployment, verify `/login`, logged-out `/api/account` = `401`, internal `/api/health` = `200`, and `swisseph_available = true`.
 5. Never expose port `5200`, `SUPABASE_SERVICE_ROLE_KEY`, model keys, user JWTs, passwords, or SSH private keys.
+6. Pushes to `main` deploy automatically only after `Jyotish Skill CI` succeeds; the production workflow and required secret are documented in `deploy/README.md`.
 
 ## 1. High-Rigor Override
 
diff --git a/deploy/README.md b/deploy/README.md
index a9f6e656..cf7c3c34 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -102,20 +102,39 @@ docker stats --no-stream
 
 The server has a persistent 2 GB `/swapfile`. UFW permits only SSH `22000/tcp`, HTTP `80/tcp`, HTTPS `443/tcp`, and the pre-existing WireGuard `51820/udp` rule.
 
-## Deploy an update from the maintainer Mac
+## Automatic deployment
 
-The GitHub repository is private and the VPS does not currently have a GitHub deploy key. Deploy the tracked tree without copying local secrets:
+A successful `Jyotish Skill CI` run for a push to `main` triggers `.github/workflows/deploy-production.yml`. The workflow syncs the tested revision with `rsync`, preserves `/opt/jyotisha-app/.env.production`, rebuilds both Docker services, and verifies the public login route, logged-out account response, and private Python health endpoint.
+
+Required GitHub Actions secret:
+
+```text
+PRODUCTION_SSH_PRIVATE_KEY = dedicated production deploy private key
+```
+
+The workflow pins the VPS Ed25519 host key and serializes deployments with the `production` concurrency group. It can also be run manually from GitHub Actions.
+
+## Manual deployment fallback
+
+If GitHub Actions is unavailable, deploy the tracked tree without copying local secrets:
 
 ```bash
 cd /Users/jesse/Downloads/Copse/astrology/yinduzhanxing
 git status --short --branch
-git archive --format=tar.gz --output=/tmp/jyotisha.tar.gz HEAD
-scp -P 22000 /tmp/jyotisha.tar.gz root@103.117.123.53:/tmp/jyotisha.tar.gz
+rsync -az --delete \
+  --exclude='.git/' \
+  --exclude='.env.production' \
+  --exclude='frontend/node_modules/' \
+  --exclude='frontend/.next/' \
+  --exclude='jyotish-app/node_modules/' \
+  --exclude='jyotish-app/dist/' \
+  -e 'ssh -p 22000' \
+  ./ root@103.117.123.53:/opt/jyotisha-app/
 ssh -p 22000 root@103.117.123.53 \
-  'cd /opt/jyotisha-app && tar -xzf /tmp/jyotisha.tar.gz && rm -f /tmp/jyotisha.tar.gz && docker compose --env-file .env.production -f deploy/docker-compose.server.yml up -d --build'
+  'cd /opt/jyotisha-app && docker compose --env-file .env.production -f deploy/docker-compose.server.yml up -d --build --remove-orphans'
 ```
 
-`git archive` does not include ignored `.env` files. Extraction preserves `/opt/jyotisha-app/.env.production`.
+The excluded `.env.production` remains only on the VPS.
 
 ## Verification