diff --git a/.gitea/workflows/backend_build-deploy-prod.yaml b/.gitea/workflows/backend_build-deploy-prod.yaml
new file mode 100644
index 0000000..f9d079e
--- /dev/null
+++ b/.gitea/workflows/backend_build-deploy-prod.yaml
@@ -0,0 +1,23 @@
+on:
+  push:
+    tags:
+      - v*
+
+name: Build and deploy the backend to production
+
+jobs:
+  build-and-push:
+    name: Build and push image
+    uses: ./workflow_build-image.yaml
+    with:
+      tag: stable
+    secrets:
+      PACKAGE_REGISTRY_ACCESS: ${{ secrets.PACKAGE_REGISTRY_ACCESS }}
+  
+  deploy-prod:
+    name: Deploy to production
+    uses: ./workflow_deploy-container.yaml
+    with:
+      environment: prod
+    secrets:
+      PACKAGE_REGISTRY_ACCESS: ${{ secrets.KUBE_CONFIG }}
diff --git a/.gitea/workflows/backend_build-deploy-stg.yaml b/.gitea/workflows/backend_build-deploy-stg.yaml
new file mode 100644
index 0000000..2cbb0f3
--- /dev/null
+++ b/.gitea/workflows/backend_build-deploy-stg.yaml
@@ -0,0 +1,25 @@
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - backend/**
+
+name: Build and deploy the backend to staging
+
+jobs:
+  build-and-push:
+    name: Build and push image
+    uses: ./workflow_build-image.yaml
+    with:
+      tag: unstable
+    secrets:
+      PACKAGE_REGISTRY_ACCESS: ${{ secrets.PACKAGE_REGISTRY_ACCESS }}
+  
+  deploy-prod:
+    name: Deploy to production
+    uses: ./workflow_deploy-container.yaml
+    with:
+      environment: stg
+    secrets:
+      PACKAGE_REGISTRY_ACCESS: ${{ secrets.KUBE_CONFIG }}
diff --git a/.gitea/workflows/backend_build-image.yaml b/.gitea/workflows/workflow_build-image.yaml
similarity index 72%
rename from .gitea/workflows/backend_build-image.yaml
rename to .gitea/workflows/workflow_build-image.yaml
index 0a40ccd..b33b03b 100644
--- a/.gitea/workflows/backend_build-image.yaml
+++ b/.gitea/workflows/workflow_build-image.yaml
@@ -1,12 +1,17 @@
 on:
-  pull_request:
-    branches:
-      - main
-    paths:
-      - backend/**
+  workflow_call:
+    inputs:
+      tag:
+        required: true
+        type: string
+    secrets:
+      PACKAGE_REGISTRY_ACCESS:
+        required: true
+
 
 name: Build and push docker image
 
+
 jobs:
   build:
     name: Build
@@ -29,5 +34,5 @@ jobs:
       uses: docker/build-push-action@v5
       with:
         context: backend
-        tags: git.kluster.moll.re/anydev/anyway-backend:latest
+        tags: git.kluster.moll.re/anydev/anyway-backend:${{intputs.tag}}
         push: true
diff --git a/.gitea/workflows/workflow_deploy-container.yaml b/.gitea/workflows/workflow_deploy-container.yaml
new file mode 100644
index 0000000..0e6601c
--- /dev/null
+++ b/.gitea/workflows/workflow_deploy-container.yaml
@@ -0,0 +1,34 @@
+on:
+  workflow_call:
+    inputs:
+      overlay:
+        required: true
+        type: string
+    secrets:
+      KUBE_CONFIG:
+        required: true
+
+
+name: Deploy the newly built container
+
+
+jobs:
+  deploy:
+    name: Deploy
+    runs-on: ubuntu-latest
+    steps:
+
+    - uses: https://gitea.com/actions/checkout@v4
+      with:
+        submodules: true
+
+    - name: setup kubectl
+      uses: https://github.com/azure/setup-kubectl@v4
+
+    - name: Set kubeconfig
+      run: |
+        echo "${{ secrets.KUBE_CONFIG }}" > kubeconfig
+
+    - name: Deploy to k8s
+      run: |
+        kubectl apply -k backend/deployment/overlays/${{ inputs.overlay }} --kubeconfig=kubeconfig
diff --git a/.gitmodules b/.gitmodules
new file mode 100644
index 0000000..c08c402
--- /dev/null
+++ b/.gitmodules
@@ -0,0 +1,3 @@
+[submodule "backend/deployment"]
+	path = backend/deployment
+	url = https://git.kluster.moll.re/anydev/anyway-backend-deployment
diff --git a/backend/deployment b/backend/deployment
new file mode 160000
index 0000000..2b8b839
--- /dev/null
+++ b/backend/deployment
@@ -0,0 +1 @@
+Subproject commit 2b8b8390bcf22042ac9c164bab17a44c1291d4bc