diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
new file mode 100644
index 0000000..d4a1687
--- /dev/null
+++ b/.github/workflows/deploy.yml
@@ -0,0 +1,39 @@
+name: deploy
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  build-and-deploy:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            ghcr.io/fowoco/server:latest
+            ghcr.io/fowoco/server:${{ github.sha }}
+
+      - name: Set up kubectl
+        run: |
+          mkdir -p ~/.kube
+          echo "${{ secrets.KUBE_CONFIG }}" | base64 -d > ~/.kube/config
+
+      - name: Rollout
+        run: |
+          kubectl -n fowoco set image deployment/server \
+            server=ghcr.io/fowoco/server:${{ github.sha }} \
+            --record=false || echo "Deployment가 아직 없으면 최초 배포 후 자동으로 적용됩니다."
diff --git a/Dockerfile b/Dockerfile
index 738e678..3b5444b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,8 +1,7 @@
-# TEMP: 심사용 임시 배포 Dockerfile — 정식 CI/CD·배포 파이프라인 확정 전까지 사용
-FROM gradle:8.10-jdk17 AS build
+FROM eclipse-temurin:17-jdk-alpine AS build
 WORKDIR /app
 COPY . .
-RUN gradle bootJar --no-daemon
+RUN chmod +x gradlew && ./gradlew bootJar --no-daemon
 
 FROM eclipse-temurin:17-jre-alpine
 WORKDIR /app