diff --git a/.github/README.md b/.gitea/README.md
similarity index 100%
rename from .github/README.md
rename to .gitea/README.md
diff --git a/.github/workflows/build-docker-images.yml b/.gitea/workflows/build-docker-images.yml
similarity index 72%
rename from .github/workflows/build-docker-images.yml
rename to .gitea/workflows/build-docker-images.yml
index f12171b..5e9105c 100644
--- a/.github/workflows/build-docker-images.yml
+++ b/.gitea/workflows/build-docker-images.yml
@@ -98,34 +98,68 @@ jobs:
             && echo "NetBird management connected." \
             || { echo "::error title=NetBird not connected::Management not connected after netbird up."; exit 1; }
 
-      - name: Deploy to RPIC-Cluster
-        # RPIC cluster is temporarily out of service. Don't let its failure
-        # block the Gimli deploy or fail the whole job. Remove this line once
-        # the cluster is back.
-        continue-on-error: true
-        uses: appleboy/ssh-action@v1
+      - name: Install kubectl
+        uses: azure/setup-kubectl@v4
         with:
-          host: ${{ secrets.RPIC_HOST }}
-          username: ${{ secrets.SSH_USER }}
-          key: ${{ secrets.RPIC_KEY }}
-          port: ${{ secrets.SSH_PORT }}
-          script: 'kubectl rollout restart deployment blog -n blog-ahmza-com'
+          version: 'v1.36.2'
+
+      - name: Configure Kubernetes access
+        env:
+          KUBE_CONFIG: ${{ secrets.TALOS_PROD_KUBE_CONFIG }}
+        run: |
+          mkdir -p "$HOME/.kube"
+
+          printf '%s' "$KUBE_CONFIG" \
+            | base64 -d \
+            > "$HOME/.kube/config"
+
+          chmod 600 "$HOME/.kube/config"
+
+      - name: Verify Kubernetes access
+        run: |
+          kubectl version --client
+
+          echo "Deployment patch:"
+          kubectl auth can-i patch deployments \
+            -n blog-ahmza-com
+
+          echo "Secret read:"
+          kubectl auth can-i get secrets \
+            -n blog-ahmza-com
+
+          kubectl -n blog-ahmza-com get deployment blog
+
+      - name: Deploy to Kubernetes
+        env:
+          IMAGE: tea.ahmza.com/ahmza/blog-ahmza-com:${{ gitea.event.head_commit.id }}
+        run: |
+          set -eu
+
+          echo "Deploying:"
+          echo "$IMAGE"
+
+          kubectl -n blog-ahmza-com \
+            set image deployment/blog \
+            blog="$IMAGE"
+
+          if ! kubectl -n blog-ahmza-com \
+            rollout status deployment/blog \
+            --timeout=5m
+          then
+            echo "::error::Deployment failed; rolling back"
+
+            kubectl -n blog-ahmza-com \
+              rollout undo deployment/blog
+
+            kubectl -n blog-ahmza-com \
+              rollout status deployment/blog \
+              --timeout=5m
+
+            exit 1
+          fi
+
+          kubectl -n blog-ahmza-com get pods -o wide
 
-      - name: Deploy to Gimli
-        uses: appleboy/ssh-action@v1
-        with:
-          host: ${{ secrets.GIMLI_HOST }}
-          username: ${{ secrets.SSH_USER }}
-          key: ${{ secrets.GIMLI_KEY }}
-          port: ${{ secrets.SSH_PORT }}
-          # Pull first, then reconcile in place with `up -d`. Avoid `compose down`:
-          # it removes caddy_cf and the default network, which severs the SSH
-          # session's own path before `up` can restore it (intermittent
-          # "remote command exited without exit status"). `up -d` only recreates
-          # containers whose image/config changed and never tears the network out
-          # from under the connection. --force-recreate ensures the new :latest
-          # image is picked up even when the tag digest changed.
-          script: 'docker compose pull && docker compose up -d --force-recreate --remove-orphans'
 
       - name: NetBird diagnostics & disconnect
         # Runs even on failure: captures final state for debugging and tears the