diff --git a/.forgejo/workflows/docker.yaml b/.forgejo/workflows/docker.yaml
new file mode 100644
index 0000000..a4d0506
--- /dev/null
+++ b/.forgejo/workflows/docker.yaml
@@ -0,0 +1,29 @@
+name: Build and push Docker image
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          registry: code.edgarpierre.fr
+          username: ${{ vars.DOCKER_PUSH_USERNAME }}
+          password: ${{ secrets.DOCKER_PUSH_PASSWORD }}
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      -
+        name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          tags: |
+            code.edgarpierre.fr/${{ github.repository }}:${{ github.ref_name }}
+            code.edgarpierre.fr/${{ github.repository }}:latest
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..2cf671d
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,17 @@
+FROM ghcr.io/astral-sh/uv:debian-slim
+
+ADD . /app
+WORKDIR /app
+
+RUN useradd -m -r musik && \
+    chown -R musik /app
+
+USER musik
+
+ENV PYTHONDONTWRITEBYTECODE=1
+ENV PYTHONUNBUFFERED=1
+ENV YOUTUBE_OAUTH_SECRETS="/config/secret.json"
+
+RUN uv sync --locked
+
+CMD ["/app/entrypoint.sh"]
diff --git a/entrypoint.sh b/entrypoint.sh
new file mode 100755
index 0000000..efa73f3
--- /dev/null
+++ b/entrypoint.sh
@@ -0,0 +1,5 @@
+#!/usr/bin/env sh
+cd /app
+uv run manage.py collectstatic --noinput
+uv run manage.py migrate --noinput
+uv run gunicorn --bind :8000 --workers 2 musik.wsgi:application
diff --git a/musik/settings.py b/musik/settings.py
index 9b1a167..370562b 100644
--- a/musik/settings.py
+++ b/musik/settings.py
@@ -119,6 +119,7 @@ USE_TZ = True
 # https://docs.djangoproject.com/en/5.2/howto/static-files/
 
 STATIC_URL = "static/"
+STATIC_ROOT = os.getenv("MUSIK_STATIC_ROOT", "./static")
 
 # Default primary key field type
 # https://docs.djangoproject.com/en/5.2/ref/settings/#default-auto-field
diff --git a/pyproject.toml b/pyproject.toml
index c289f43..204fa92 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -11,6 +11,7 @@ dependencies = [
     "google-auth>=2.40.3",
     "google-auth-httplib2>=0.2.0",
     "google-auth-oauthlib>=1.2.2",
+    "gunicorn>=23.0.0",
     "requests>=2.32.4",
 ]
 
diff --git a/uv.lock b/uv.lock
index c9bd1ae..d4175cd 100644
--- a/uv.lock
+++ b/uv.lock
@@ -342,6 +342,18 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/86/f1/62a193f0227cf15a920390abe675f386dec35f7ae3ffe6da582d3ade42c7/googleapis_common_protos-1.70.0-py3-none-any.whl", hash = "sha256:b8bfcca8c25a2bb253e0e0b0adaf8c00773e5e6af6fd92397576680b807e0fd8", size = 294530, upload-time = "2025-04-14T10:17:01.271Z" },
 ]
 
+[[package]]
+name = "gunicorn"
+version = "23.0.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "packaging" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/34/72/9614c465dc206155d93eff0ca20d42e1e35afc533971379482de953521a4/gunicorn-23.0.0.tar.gz", hash = "sha256:f014447a0101dc57e294f6c18ca6b40227a4c90e9bdb586042628030cba004ec", size = 375031, upload-time = "2024-08-10T20:25:27.378Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/cb/7d/6dac2a6e1eba33ee43f318edbed4ff29151a49b5d37f080aad1e6469bca4/gunicorn-23.0.0-py3-none-any.whl", hash = "sha256:ec400d38950de4dfd418cff8328b2c8faed0edb0d517d3394e457c317908ca4d", size = 85029, upload-time = "2024-08-10T20:25:24.996Z" },
+]
+
 [[package]]
 name = "httplib2"
 version = "0.22.0"
@@ -420,6 +432,7 @@ dependencies = [
     { name = "google-auth" },
     { name = "google-auth-httplib2" },
     { name = "google-auth-oauthlib" },
+    { name = "gunicorn" },
     { name = "requests" },
 ]
 
@@ -437,6 +450,7 @@ requires-dist = [
     { name = "google-auth", specifier = ">=2.40.3" },
     { name = "google-auth-httplib2", specifier = ">=0.2.0" },
     { name = "google-auth-oauthlib", specifier = ">=1.2.2" },
+    { name = "gunicorn", specifier = ">=23.0.0" },
     { name = "requests", specifier = ">=2.32.4" },
 ]