diff --git a/.forgejo/workflows/build-deploy.yml b/.forgejo/workflows/build-deploy.yml
index d14c8c63..8d47c1a4 100644
--- a/.forgejo/workflows/build-deploy.yml
+++ b/.forgejo/workflows/build-deploy.yml
@@ -62,41 +62,3 @@ jobs:
             ${{ steps.meta.outputs.latest_tag }}
           cache-from: type=registry,ref=${{ steps.meta.outputs.cache_tag }}
           cache-to: type=registry,ref=${{ steps.meta.outputs.cache_tag }},mode=max
-
-  deploy:
-    needs: build
-    runs-on: ubuntu-latest
-    steps:
-      - name: Extract metadata
-        id: meta
-        run: |
-          TIMESTAMP=$(date +%s)
-          SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
-          IMAGE=${{ secrets.REGISTRY_URL }}/${{ github.repository }}
-          echo "tag=${IMAGE}:main-${TIMESTAMP}-${SHORT_SHA}" >> $GITHUB_OUTPUT
-
-      - name: Set up kubectl
-        uses: https://github.com/azure/setup-kubectl@v4
-        with:
-          version: 'latest'
-
-      - name: Deploy to Kubernetes
-        env:
-          KUBECONFIG_DATA: ${{ secrets.KUBECONFIG }}
-        run: |
-          # Set up kubeconfig
-          mkdir -p $HOME/.kube
-          echo "$KUBECONFIG_DATA" | base64 -d > $HOME/.kube/config
-          chmod 600 $HOME/.kube/config
-
-          # Verify connection
-          kubectl config get-contexts
-          kubectl config use-context towerops/towerops:home-cluster-agent
-
-          # Set deployment timestamp (ISO 8601 format in UTC)
-          DEPLOY_TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
-          echo "Deploying at $DEPLOY_TIMESTAMP"
-
-          # Deploy new version (migrations run on app start)
-          kubectl set image deployment/towerops towerops=${{ steps.meta.outputs.tag }} -n towerops
-          kubectl set env deployment/towerops DEPLOY_TIMESTAMP=$DEPLOY_TIMESTAMP -n towerops
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
new file mode 100644
index 00000000..dc2cd352
--- /dev/null
+++ b/.gitlab-ci.yml
@@ -0,0 +1,65 @@
+stages:
+  - build
+  - deploy
+
+variables:
+  DOCKER_BUILDKIT: 1
+  CI_BUILDX_ARCHS: "linux/amd64"
+  DOCKER_TLS_CERTDIR: ""
+
+workflow:
+  auto_cancel:
+    on_new_commit: interruptible
+
+build:
+  stage: build
+  interruptible: true
+  tags:
+    - home
+  image: docker:27
+  services:
+    - docker:27-dind
+  before_script:
+    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
+  script:
+    # Pull latest image for layer caching (ignore failures if not exists)
+    - docker pull $CI_REGISTRY_IMAGE:latest || true
+    # Build with cache-from for faster builds and inline cache for future builds
+    - docker build
+      --cache-from $CI_REGISTRY_IMAGE:latest
+      --build-arg BUILDKIT_INLINE_CACHE=1
+      -f k8s/Dockerfile
+      -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
+      -t $CI_REGISTRY_IMAGE:latest
+      .
+    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
+    - docker push $CI_REGISTRY_IMAGE:latest
+  rules:
+    - if: $CI_COMMIT_BRANCH == "main"
+
+deploy:
+  stage: deploy
+  needs:
+    - job: build
+      artifacts: false
+  tags:
+    - home
+  image:
+    name: bitnami/kubectl:latest
+    entrypoint: [""]
+  script:
+    - kubectl config get-contexts
+    - kubectl config use-context towerops/towerops:home-cluster-agent
+    # Set deployment timestamp (ISO 8601 format in UTC)
+    - DEPLOY_TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+    - echo "Deploying at $DEPLOY_TIMESTAMP"
+    # Deploy new version (migrations run on app start)
+    - kubectl set image deployment/towerops towerops=$CI_REGISTRY_IMAGE:$CI_COMMIT_SHA -n towerops
+    - kubectl set env deployment/towerops DEPLOY_TIMESTAMP=$DEPLOY_TIMESTAMP -n towerops
+    # Don't wait for rollout completion - let Kubernetes handle it asynchronously
+  environment:
+    name: production
+    kubernetes:
+      namespace: towerops
+  rules:
+    - if: $CI_COMMIT_BRANCH == "main"