diff --git a/k8s/workflows-deployment.yaml b/k8s/workflows-deployment.yaml
new file mode 100644
index 0000000..921e9fd
--- /dev/null
+++ b/k8s/workflows-deployment.yaml
@@ -0,0 +1,112 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: poimen-workflows
+  namespace: poimen
+  labels:
+    app.kubernetes.io/name: poimen
+    app.kubernetes.io/component: worker
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: poimen-workflows
+      app.kubernetes.io/name: poimen
+      app.kubernetes.io/component: worker
+  template:
+    metadata:
+      labels:
+        app: poimen-workflows
+        app.kubernetes.io/name: poimen
+        app.kubernetes.io/component: worker
+    spec:
+      imagePullSecrets:
+      - name: poimen-registry
+      containers:
+      # Workflows server (HTTP, health checks)
+      - name: workflows-server
+        image: forgejo.riotpiao.com/rock/poimen-workflows:latest
+        imagePullPolicy: Always
+        command: ["/app/worker", "server"]
+        ports:
+        - containerPort: 8080
+          name: http
+        env:
+        - name: DATABASE_URL
+          valueFrom:
+            secretKeyRef:
+              name: poimen-db-credentials
+              key: workflows-url
+        - name: TEMPORAL_HOSTPORT
+          valueFrom:
+            configMapKeyRef:
+              name: poimen-config
+              key: temporal-hostport
+        - name: TEMPORAL_NAMESPACE
+          valueFrom:
+            configMapKeyRef:
+              name: poimen-config
+              key: temporal-namespace
+        - name: MEMORY_SERVICE_URL
+          valueFrom:
+            configMapKeyRef:
+              name: poimen-config
+              key: memory-service-url
+        - name: JWT_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: poimen-secrets
+              key: jwt-secret
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: 8080
+          initialDelaySeconds: 10
+          periodSeconds: 10
+        readinessProbe:
+          httpGet:
+            path: /ready
+            port: 8080
+          initialDelaySeconds: 5
+          periodSeconds: 5
+        resources:
+          requests:
+            memory: "256Mi"
+            cpu: "250m"
+          limits:
+            memory: "1Gi"
+            cpu: "1000m"
+
+      # Temporal worker (activity executor)
+      - name: workflows-worker
+        image: forgejo.riotpiao.com/rock/poimen-workflows:latest
+        imagePullPolicy: Always
+        command: ["/app/worker"]
+        env:
+        - name: DATABASE_URL
+          valueFrom:
+            secretKeyRef:
+              name: poimen-db-credentials
+              key: workflows-url
+        - name: TEMPORAL_HOSTPORT
+          valueFrom:
+            configMapKeyRef:
+              name: poimen-config
+              key: temporal-hostport
+        - name: TEMPORAL_NAMESPACE
+          valueFrom:
+            configMapKeyRef:
+              name: poimen-config
+              key: temporal-namespace
+        - name: MEMORY_SERVICE_URL
+          valueFrom:
+            configMapKeyRef:
+              name: poimen-config
+              key: memory-service-url
+        resources:
+          requests:
+            memory: "512Mi"
+            cpu: "500m"
+          limits:
+            memory: "2Gi"
+            cpu: "2000m"