diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
new file mode 100644
index 0000000..c2ceb51
--- /dev/null
+++ b/.gitea/workflows/deploy.yml
@@ -0,0 +1,49 @@
+name: Deploy PDS
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install Ansible
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y -qq ansible
+
+      - name: Write SSH key
+        env:
+          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
+        run: |
+          mkdir -p ~/.ssh
+          echo "$SSH_PRIVATE_KEY" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          ssh-keyscan -H ${{ vars.SERVER_IP }} >> ~/.ssh/known_hosts
+
+      - name: Generate inventory
+        run: |
+          cat > inventory.yml <<EOF
+          all:
+            hosts:
+              pds:
+                ansible_host: ${{ vars.SERVER_IP }}
+          EOF
+
+      - name: Generate vars
+        run: |
+          cat > vars/main.yml <<EOF
+          pds_hostname: ${{ vars.PDS_HOSTNAME }}
+          pds_admin_email: ${{ vars.PDS_ADMIN_EMAIL }}
+          pds_blobstore_s3_access_key: ${{ secrets.OVH_S3_ACCESS_KEY }}
+          pds_blobstore_s3_secret_key: ${{ secrets.OVH_S3_SECRET_KEY }}
+          EOF
+
+      - name: Run playbook
+        run: |
+          ansible-playbook -i inventory.yml playbook.yml
diff --git a/README.md b/README.md
index 8f677a6..cd28d19 100644
--- a/README.md
+++ b/README.md
@@ -20,7 +20,7 @@ Ansible playbook for deploying a self-hosted [Bluesky PDS](https://github.com/bl
 
 ```bash
 cp inventory.yml.example inventory.yml       # set your server IP
-cp vars/main.yml.example vars/main.yml       # set your hostname and admin email
+cp vars/main.yml.example vars/main.yml       # set hostname, admin email, S3/SMTP creds
 ```
 
 Edit `inventory.yml`:
@@ -37,6 +37,8 @@ Edit `vars/main.yml`:
 ```yaml
 pds_hostname: bsky.example.com
 pds_admin_email: you@example.com
+pds_blobstore_s3_access_key: your-access-key
+pds_blobstore_s3_secret_key: your-secret-key
 ```
 
 ## Deploy
@@ -63,8 +65,10 @@ ansible-playbook playbook.yml
 | `pds_rate_limits_enabled` | no | `true` | Enable rate limiting |
 | `pds_invite_required` | no | `true` | Require invite codes to create accounts |
 | `pds_blobstore_type` | no | `disk` | Blob storage backend (`disk` or `s3`) |
-| `pds_email_smtp_url` | no | — | SMTP URL for email verification |
 | `pds_email_from_address` | no | — | From address for outgoing emails |
+| `pds_blobstore_s3_access_key` | yes (if S3) | — | S3 access key for blob storage |
+| `pds_blobstore_s3_secret_key` | yes (if S3) | — | S3 secret key for blob storage |
+| `pds_email_smtp_url` | no | — | SMTP URL (with credentials) for email verification |
 
 ## Auto-updates
 
@@ -88,3 +92,25 @@ pdsadmin account create
 
 - `pds.env` is Ansible-managed. Secrets (JWT, admin password, PLC rotation key) are generated by the installer on first run, then read and preserved by Ansible on subsequent runs. To change config like S3 or SMTP, update `vars/main.yml` and re-run the playbook.
 - The installer creates a `pds.service` systemd unit. It's left in place — it just runs `docker compose up -d` on boot. Docker's `restart: unless-stopped` policy also handles this independently.
+
+## CI/CD (Gitea Actions)
+
+Auto-deploys on push to `main`. Set up these in Gitea repo settings (Settings > Actions):
+
+**Variables** (non-sensitive config):
+
+| Variable | Description |
+|---|---|
+| `SERVER_IP` | Target server IP address |
+| `PDS_HOSTNAME` | Public DNS name for the PDS (e.g., `pds.example.com`) |
+| `PDS_ADMIN_EMAIL` | Admin contact email |
+
+**Secrets** (sensitive credentials):
+
+| Secret | Description |
+|---|---|
+| `SSH_PRIVATE_KEY` | Private SSH key for the `sysadmin` user on the target server |
+| `OVH_S3_ACCESS_KEY` | OVH S3 access key for blob storage |
+| `OVH_S3_SECRET_KEY` | OVH S3 secret key for blob storage |
+
+The workflow installs Ansible, writes the SSH key from a secret, generates `inventory.yml` and `vars/main.yml` from vars and secrets, and runs the playbook.