diff --git a/.woodpecker/deployment.yml b/.woodpecker/deployment.yml
new file mode 100644
index 0000000..cb7abf1
--- /dev/null
+++ b/.woodpecker/deployment.yml
@@ -0,0 +1,37 @@
+when:
+  event: tag
+  ref: refs/tags/v*
+
+steps:
+  deploy:
+    image: alpine/k8s:1.27.11
+    secrets:
+      - kubeconfig
+    commands:
+      - mkdir ~/.kube && echo \"$KUBECONFIG\" > ~/.kube/twhelp
+      - cd ./k8s/overlays/prod
+      - kustomize edit set image twhelp=gitea.dwysokinski.me/twhelp/core:${CI_COMMIT_TAG##v}
+      - cd ../../..
+      - kubectl --kubeconfig ~/.kube/twhelp -n twhelp delete jobs.batch twhelp-migrations-job || true
+      - kustomize build ./k8s/overlays/prod | kubectl --kubeconfig ~/.kube/twhelp apply -n twhelp -f -
+
+  email:
+    image: deblan/woodpecker-email
+    settings:
+      dsn:
+        from_secret: email_dsn
+      from:
+        address:
+          from_secret: email_from_address
+        name: Woodpecker
+      recipients:
+        - notifications@twhelp.app
+      recipients_only: true
+      subject:
+        "[deployment - {{ pipeline.status }}] {{ repo.full_name }} ({{ commit.tag }}"
+    when:
+      status: [success, failure]
+      event: cron
+
+depends_on:
+  - release
diff --git a/.woodpecker/govulncheck.yml b/.woodpecker/govulncheck.yml
index b6bde87..441a68e 100644
--- a/.woodpecker/govulncheck.yml
+++ b/.woodpecker/govulncheck.yml
@@ -18,7 +18,7 @@ steps:
       - go install golang.org/x/vuln/cmd/govulncheck@latest
       - govulncheck ./...
 
-  notify:
+  email:
     image: deblan/woodpecker-email
     settings:
       dsn:
diff --git a/.woodpecker/release.yml b/.woodpecker/release.yml
index 01ee67b..45b8d8e 100644
--- a/.woodpecker/release.yml
+++ b/.woodpecker/release.yml
@@ -1,5 +1,6 @@
 when:
   event: tag
+  ref: refs/tags/v*
 
 variables:
   - &go_image 'golang:1.22'