diff --git a/.githooks/pre-push b/.githooks/pre-push
new file mode 100644
index 0000000..4b4b1ef
--- /dev/null
+++ b/.githooks/pre-push
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Runs on `git push`. If a tag ref is among what's being pushed, build locally
+# and deploy to the server. Normal branch pushes are untouched.
+set -euo pipefail
+
+deploy=0
+tag=""
+while read -r local_ref _local_sha _remote_ref _remote_sha; do
+  case "$local_ref" in
+    refs/tags/*)
+      deploy=1
+      tag="${local_ref#refs/tags/}"
+      ;;
+  esac
+done
+
+if [ "$deploy" = "1" ]; then
+  echo "→ Tag '$tag' is being pushed — building locally and deploying to the server…"
+  exec "$(git rev-parse --show-toplevel)/scripts/deploy.sh"
+fi
+
+exit 0
diff --git a/scripts/deploy.sh b/scripts/deploy.sh
new file mode 100644
index 0000000..992da46
--- /dev/null
+++ b/scripts/deploy.sh
@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# Build the static site locally, then replace the server directory with it.
+#
+#   - Builds on THIS machine (npm run build -> ./out).
+#   - Streams out/ over a single SSH connection (tar pipe) and swaps the
+#     contents of the target dir on the server. No rsync/sshpass required.
+#
+# Password handling:
+#   - If `sshpass` is installed AND DEPLOY_PASSWORD is set (env or .env.deploy),
+#     the deploy is fully unattended.
+#   - Otherwise SSH prompts for the password once (interactive).
+#
+# Config (override via env or .env.deploy):
+set -euo pipefail
+cd "$(git rev-parse --show-toplevel 2>/dev/null || dirname "$(dirname "$0")")"
+
+# Optional local secrets file (gitignored).
+[ -f .env.deploy ] && . ./.env.deploy
+
+DEPLOY_HOST="${DEPLOY_HOST:-185.226.116.88}"
+DEPLOY_USER="${DEPLOY_USER:-ubuntu}"
+DEPLOY_PATH="${DEPLOY_PATH:-/var/www/appro-admin}"
+DEPLOY_PASSWORD="${DEPLOY_PASSWORD:-}"
+
+echo "▸ Building locally…"
+npm run build
+
+if [ ! -d out ]; then
+  echo "✗ Build did not produce ./out" >&2
+  exit 1
+fi
+
+# Pick the SSH command: unattended with sshpass, else interactive prompt.
+ssh_cmd=(ssh -o StrictHostKeyChecking=no "$DEPLOY_USER@$DEPLOY_HOST")
+if command -v sshpass >/dev/null 2>&1 && [ -n "$DEPLOY_PASSWORD" ]; then
+  ssh_cmd=(sshpass -p "$DEPLOY_PASSWORD" "${ssh_cmd[@]}")
+else
+  echo "ℹ sshpass/password not available — SSH will prompt for the password."
+fi
+
+echo "▸ Uploading to $DEPLOY_USER@$DEPLOY_HOST:$DEPLOY_PATH …"
+# Replace the directory contents (incl. dotfiles) then extract the new build.
+tar -C out -czf - . | "${ssh_cmd[@]}" \
+  "set -e; mkdir -p '$DEPLOY_PATH'; find '$DEPLOY_PATH' -mindepth 1 -delete; tar -C '$DEPLOY_PATH' -xzf -"
+
+echo "✓ Deployed to $DEPLOY_HOST:$DEPLOY_PATH"