diff --git a/.gitea/workflows/zig-build.yaml b/.gitea/workflows/zig-build.yaml
index bb2e5ad..c63ba93 100644
--- a/.gitea/workflows/zig-build.yaml
+++ b/.gitea/workflows/zig-build.yaml
@@ -29,3 +29,42 @@ jobs:
           status: ${{ job.status }}
           user: ${{ secrets.NTFY_USER }}
           password: ${{ secrets.NTFY_PASSWORD }}
+  deploy:
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/catthehacker/ubuntu:act-22.04
+    needs: build
+    # Only publish images from the default branch. Other branches still
+    # build + test in the job above, but must not move :latest.
+    if: github.ref == 'refs/heads/master'
+    steps:
+      - name: Check out repository code
+        uses: actions/checkout@v4
+      - name: Get short ref
+        id: vars
+        run: echo "shortsha=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
+      - name: Login to Gitea
+        uses: docker/login-action@v2
+        with:
+          registry: git.lerch.org
+          username: ${{ github.actor }}
+          password: ${{ secrets.PACKAGE_PUSH }}
+      # Builds the repo-root multi-stage Dockerfile (installs libnotmuch/gmime,
+      # compiles the zig binary, and produces the Debian runtime image).
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            git.lerch.org/${{ github.repository }}:${{ steps.vars.outputs.shortsha }}
+            git.lerch.org/${{ github.repository }}:latest
+      - name: Notify
+        uses: https://git.lerch.org/lobo/action-notify-ntfy@v2
+        if: always() && env.GITEA_ACTIONS == 'true'
+        with:
+          host: ${{ secrets.NTFY_HOST }}
+          topic: ${{ secrets.NTFY_TOPIC }}
+          status: ${{ job.status }}
+          user: ${{ secrets.NTFY_USER }}
+          password: ${{ secrets.NTFY_PASSWORD }}