diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index ea6a3a2..334dcd5 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,6 +1,7 @@
 stages:
   - build-and-test
   - build-docker-image
+  - deploy
 
 build-and-test:
   image: rocker/tidyverse
@@ -30,6 +31,7 @@
 
 build-docker-image:
   image: docker:latest
+  stage: build-docker-image
   services:
     - docker:dind
   rules:
@@ -40,7 +42,6 @@
       variables:
         VID_ALT: $CI_COMMIT_BRANCH-$CI_COMMIT_SHORT_SHA
         VID: snapshot
-  stage: build-docker-image
   cache:
     key: corpuscomposition
     paths:
@@ -61,3 +62,31 @@
     paths:
       - corpuscomposition-$VID.xz
 
+deploy:
+  image: openjdk:17
+  stage: deploy
+  dependencies:
+    - build-docker-image
+  rules:
+    - if: $CI_COMMIT_TAG =~ /.+/
+      variables:
+        VID: $CI_COMMIT_TAG
+    - when: manual
+      variables:
+        VID_ALT: $CI_COMMIT_BRANCH-$CI_COMMIT_SHORT_SHA
+        VID: snapshot
+  before_script:
+    #  - echo `pwd` # debug
+    #  - echo "$CI_BUILD_NAME, $CI_BUILD_REF_NAME $CI_BUILD_STAGE" # debug
+    - export GRADLE_USER_HOME=`pwd`/.gradle
+    - microdnf install findutils openssh-clients
+    - eval $(ssh-agent -s)
+    - chmod 400 "$SSH_PRIVATE_KEY"
+    - ssh-add "$SSH_PRIVATE_KEY"
+    - mkdir -p ~/.ssh
+    - chmod 700 ~/.ssh
+  script:
+    - ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null $DEPLOY_HOST "unxz | docker load" < corpuscomposition-$VID.xz
+    - ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null $DEPLOY_HOST 'docker kill corpuscomposition && docker run -d --rm --name="corpuscomposition" -p 3838:3838 korap/corpuscomposition.slim'
+
+