diff --git a/.github/workflows/fly-deploy.yml b/.github/workflows/fly-deploy.yml
deleted file mode 100644
index b0c246ed..00000000
--- a/.github/workflows/fly-deploy.yml
+++ /dev/null
@@ -1,18 +0,0 @@
-# See https://fly.io/docs/app-guides/continuous-deployment-with-github-actions/
-
-name: Fly Deploy
-on:
-  push:
-    branches:
-      - main
-jobs:
-  deploy:
-    name: Deploy app
-    runs-on: ubuntu-latest
-    concurrency: deploy-group    # optional: ensure only one action runs at a time
-    steps:
-      - uses: actions/checkout@v4
-      - uses: superfly/flyctl-actions/setup-flyctl@master
-      - run: flyctl deploy --remote-only
-        env:
-          FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}
diff --git a/.github/workflows/prod-deploy.yml b/.github/workflows/prod-deploy.yml
new file mode 100644
index 00000000..f282b89b
--- /dev/null
+++ b/.github/workflows/prod-deploy.yml
@@ -0,0 +1,23 @@
+name: Prod Deploy
+on:
+  push:
+    branches:
+      - main
+jobs:
+  deploy:
+    name: Deploy to Prod
+    runs-on: ubuntu-latest
+    concurrency: deploy-group    # optional: ensure only one action runs at a time
+    steps:
+      - name: Execute remote SSH commands using password
+        uses: appleboy/ssh-action@v1
+        with:
+          host: ${{ secrets.HOST }}
+          username: ${{ secrets.USERNAME }}
+          password: ${{ secrets.PASSWORD }}
+          script: |
+            cd /home/deploy/source-be
+            git checkout main
+            git pull
+            ./build.sh
+            sudo /bin/systemctl restart source-be
diff --git a/.github/workflows/staging-deploy.yml b/.github/workflows/staging-deploy.yml
new file mode 100644
index 00000000..1170aa1e
--- /dev/null
+++ b/.github/workflows/staging-deploy.yml
@@ -0,0 +1,25 @@
+name: Staging Deploy
+on:
+  push:
+    branches:
+      - dev
+jobs:
+  deploy:
+    name: Deploy to Staging
+    runs-on: ubuntu-latest
+    concurrency: deploy-group    # optional: ensure only one action runs at a time
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Connect to Tailscale
+        uses: tailscale/github-action@v4
+        with:
+          authKey: ${{ secrets.TS_AUTH_KEY }}
+          tags: tag:ci
+
+      - name: Deploy via SSH
+        run: |
+          ssh -o StrictHostKeyChecking=no merv@mervstation.tail4f070.ts.net
+          cd /home/merv/Developer/source-be
+          git pull
+          sudo /bin/systemctl restart source-be
diff --git a/.gitignore b/.gitignore
index 576bdd4f..11809f10 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,6 +8,7 @@ source-users
 dev/dev.clj
 .nrepl-port
 target/
+resources/admins_encrypted.json
 
 .db
 admins.json