diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index c7404bb..102a3f0 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -32,6 +32,7 @@ jobs:
           apt-get install -y docker.io
 
       - name: Login to Docker Hub
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         env:
           DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
           DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -41,13 +42,69 @@ jobs:
             --password-stdin
 
       - name: Build Docker image
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         run: |
           docker build \
             -t mikhaillobanov/devops-platform:latest \
-            -t mikhaillobanov/devops-platform:${GITHUB_SHA::7} \
+            -t mikhaillobanov/devops-platform:${GITHUB_SHA} \
             .
 
       - name: Push Docker image
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         run: |
           docker push mikhaillobanov/devops-platform:latest
-          docker push mikhaillobanov/devops-platform:${GITHUB_SHA::7}
+          docker push mikhaillobanov/devops-platform:${GITHUB_SHA}
+
+      - name: Deploy application
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        env:
+          IMAGE: mikhaillobanov/devops-platform:${{ github.sha }}
+        run: |
+          set -eu
+
+          OLD_IMAGE=$(docker inspect --format='{{.Image}}' devops-platform)
+
+          docker pull "$IMAGE"
+          docker stop devops-platform
+          docker rm devops-platform
+
+          if docker run -d \
+            --name devops-platform \
+            --restart unless-stopped \
+            -p 127.0.0.1:8000:8000 \
+            "$IMAGE"; then
+            echo "New container started"
+          else
+            echo "Failed to start new container; restoring old image"
+            docker run -d \
+              --name devops-platform \
+              --restart unless-stopped \
+              -p 127.0.0.1:8000:8000 \
+              "$OLD_IMAGE"
+            exit 1
+          fi
+
+          HEALTHY=false
+
+          for attempt in $(seq 1 15); do
+            if docker exec devops-platform python -c \
+              "import urllib.request; r=urllib.request.urlopen('http://127.0.0.1:8000/health', timeout=2); assert r.status == 200"; then
+              HEALTHY=true
+              break
+            fi
+            sleep 2
+          done
+
+          if [ "$HEALTHY" = true ]; then
+            echo "Deployment successful"
+          else
+            echo "Health check failed; rolling back"
+            docker stop devops-platform || true
+            docker rm devops-platform || true
+            docker run -d \
+              --name devops-platform \
+              --restart unless-stopped \
+              -p 127.0.0.1:8000:8000 \
+              "$OLD_IMAGE"
+            exit 1
+          fi