diff --git a/.github/workflows/delivery.yml b/.github/workflows/delivery.yml
new file mode 100644
index 0000000..c9c0e92
--- /dev/null
+++ b/.github/workflows/delivery.yml
@@ -0,0 +1,99 @@
+name: delivery
+
+on:
+  push:
+    branches:
+      - master
+  workflow_dispatch:
+
+concurrency:
+  group: production-delivery
+  cancel-in-progress: false
+
+env:
+  REGISTRY: git.kandrusyak.ru
+  IMAGE: git.kandrusyak.ru/admin/kandrusyak-bot
+
+jobs:
+  quality:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.10", "3.12"]
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+      - name: Install test dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -r requirements-common.txt -r requirements-dev.txt
+      - name: Lint
+        run: python -m ruff check .
+      - name: Test with coverage
+        run: |
+          python -m coverage run -m unittest discover -v
+          python -m coverage report
+
+  build-and-push:
+    needs: quality
+    runs-on: docker-build
+    timeout-minutes: 30
+
+    steps:
+      - uses: actions/checkout@v4
+      - name: Log in to the container registry
+        env:
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          test -n "$REGISTRY_TOKEN"
+          printf '%s' "$REGISTRY_TOKEN" |
+            docker login "$REGISTRY" --username admin --password-stdin
+      - name: Build the cloud image
+        run: |
+          docker build \
+            --target yandex \
+            --label "org.opencontainers.image.revision=$GITHUB_SHA" \
+            --label "org.opencontainers.image.source=$GITHUB_SERVER_URL/$GITHUB_REPOSITORY" \
+            --tag "$IMAGE:$GITHUB_SHA" \
+            --tag "$IMAGE:latest" \
+            .
+      - name: Push immutable and latest tags
+        run: |
+          docker push "$IMAGE:$GITHUB_SHA"
+          docker push "$IMAGE:latest"
+      - name: Log out from the container registry
+        if: ${{ always() }}
+        run: docker logout "$REGISTRY" || true
+
+  deploy:
+    needs: build-and-push
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Configure the deployment key
+        env:
+          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+          DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
+        run: |
+          install -d -m 700 "$HOME/.ssh"
+          printf '%s\n' "$DEPLOY_SSH_KEY" > "$HOME/.ssh/deploy_key"
+          printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > "$HOME/.ssh/known_hosts"
+          chmod 600 "$HOME/.ssh/deploy_key" "$HOME/.ssh/known_hosts"
+      - name: Deploy the published commit
+        run: |
+          ssh \
+            -i "$HOME/.ssh/deploy_key" \
+            -o IdentitiesOnly=yes \
+            -o BatchMode=yes \
+            -o StrictHostKeyChecking=yes \
+            -p 22 \
+            kandrusyak-bot@hole.kandrusyak.ru \
+            "deploy $GITHUB_SHA"
+      - name: Remove the deployment key
+        if: ${{ always() }}
+        run: rm -f "$HOME/.ssh/deploy_key"
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
deleted file mode 100644
index 0ea62d4..0000000
--- a/.github/workflows/quality.yml
+++ /dev/null
@@ -1,29 +0,0 @@
-name: quality
-
-on:
-  push:
-  pull_request:
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        python-version: ["3.10", "3.12"]
-
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
-        with:
-          python-version: ${{ matrix.python-version }}
-          cache: pip
-      - name: Install test dependencies
-        run: |
-          python -m pip install --upgrade pip
-          python -m pip install -r requirements-common.txt -r requirements-dev.txt
-      - name: Lint
-        run: python -m ruff check .
-      - name: Test with coverage
-        run: |
-          python -m coverage run -m unittest discover -v
-          python -m coverage report
diff --git a/.gitignore b/.gitignore
index ee9cd76..ec2a6e5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,5 @@
 .env
+.env_gitea_token
 .venv/
 .idea/
 __pycache__/
diff --git a/deploy/compose.yaml b/deploy/compose.yaml
new file mode 100644
index 0000000..267f617
--- /dev/null
+++ b/deploy/compose.yaml
@@ -0,0 +1,27 @@
+services:
+  bot:
+    image: git.kandrusyak.ru/admin/kandrusyak-bot:${IMAGE_TAG:?IMAGE_TAG is required}
+    container_name: kandrusyak-bot
+    restart: unless-stopped
+    env_file:
+      - .env
+    environment:
+      ASSISTANT_MODE: yandex
+      ASSISTANT_DB: /data/assistant_data.sqlite3
+    volumes:
+      - bot-data:/data
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    tmpfs:
+      - /tmp:size=64m,mode=1777
+    logging:
+      driver: json-file
+      options:
+        max-size: 10m
+        max-file: "3"
+
+volumes:
+  bot-data:
+    name: kandrusyak-bot-data