diff --git a/.gitea/workflows/docker-build.yml b/.gitea/workflows/docker-build.yml
new file mode 100644
index 0000000..6f2fd42
--- /dev/null
+++ b/.gitea/workflows/docker-build.yml
@@ -0,0 +1,37 @@
+# Build and push the TLC Search Docker image whenever changes land on master.
+name: docker-build
+
+on:
+  push:
+    branches:
+      - master
+
+env:
+  IMAGE_NAME: gitea.ghost.tel/knight/tlc-search
+
+jobs:
+  build:
+    runs-on: docker
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to registry
+        uses: docker/login-action@v2
+        with:
+          registry: gitea.ghost.tel
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Build and push image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: Dockerfile
+          push: true
+          tags: |
+            ${{ env.IMAGE_NAME }}:latest
+            ${{ env.IMAGE_NAME }}:${{ github.sha }}
diff --git a/README.md b/README.md
index de87c2c..1ec3e7f 100644
--- a/README.md
+++ b/README.md
@@ -104,3 +104,12 @@ Other tunables (defaults shown in compose):
 - `QDRANT_VECTOR_NAME` / `QDRANT_VECTOR_SIZE` / `QDRANT_EMBED_MODEL`
 
 Port 8080 on the host is forwarded to the app. Mount `./data` (read-only) if you want local fallbacks for metrics (`LOCAL_DATA_DIR=/app/data/video_metadata`); otherwise the app will rely purely on the remote backends. Stop the container with `docker compose down`.
+
+## CI (Docker build)
+
+A Gitea Actions workflow (`.gitea/workflows/docker-build.yml`) builds and pushes the Docker image on every push to `master`. Configure the following repository secrets in Gitea:
+
+- `DOCKER_USERNAME`
+- `DOCKER_PASSWORD`
+
+The image is tagged as `gitea.ghost.tel/knight/tlc-search:latest` and with the commit SHA. Adjust `IMAGE_NAME` in the workflow if you need a different registry/repo.