diff --git a/.gitea/workflows/build-prod.yaml b/.gitea/workflows/build-prod.yaml
new file mode 100644
index 0000000..5d2f46c
--- /dev/null
+++ b/.gitea/workflows/build-prod.yaml
@@ -0,0 +1,36 @@
+name: build-prod
+
+on:
+  push:
+    branches: [prod]
+
+jobs:
+  build-push:
+    runs-on: docker
+    permissions:
+      packages: write
+    steps:
+      - name: install buildx and git
+        run: apk add --no-cache docker git
+
+      - uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build and push image (commit SHA + latest)
+        run: |
+          COMMIT_SHA=${{ github.sha }}
+          SHORT_SHA=${COMMIT_SHA:0:7}
+          IMAGE_NAME="forgejo.riotpiao.com/rock/kmsvc-manage"
+          
+          docker build \
+            -t ${IMAGE_NAME}:${SHORT_SHA} \
+            -t ${IMAGE_NAME}:latest \
+            .
+          
+          # For now, tag locally. When registry auth is configured:
+          # docker push ${IMAGE_NAME}:${SHORT_SHA}
+          # docker push ${IMAGE_NAME}:latest
+          
+          echo "Built image: ${IMAGE_NAME}:${SHORT_SHA} and ${IMAGE_NAME}:latest"