diff --git a/.gitea/workflows/checks.yaml b/.gitea/workflows/checks.yaml
index 872bd14..d04edd5 100644
--- a/.gitea/workflows/checks.yaml
+++ b/.gitea/workflows/checks.yaml
@@ -1,9 +1,10 @@
 name: checks
 
-# Checks only, nothing here deploys
+# Checks only, nothing here deploys. deploy.yaml calls it before deploying.
 on:
   push:
   pull_request:
+  workflow_call:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml
new file mode 100644
index 0000000..c8df796
--- /dev/null
+++ b/.gitea/workflows/deploy.yaml
@@ -0,0 +1,33 @@
+name: deploy
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  checks:
+    if: vars.DEPLOY_SEGA == 'true'
+    uses: ./.gitea/workflows/checks.yaml
+  prek:
+    if: vars.DEPLOY_SEGA == 'true'
+    uses: ./.gitea/workflows/prek.yaml
+
+  # sega's authorized_keys sends this key to mdb-deploy, which reads the sha from the ssh
+  # command line, builds that commit on the host and switches to it (edb-infra's
+  # roles/mdb.md).
+  deploy-sega:
+    if: vars.DEPLOY_SEGA == 'true'
+    runs-on: ubuntu-latest
+    needs:
+      - checks
+      - prek
+    steps:
+      - name: Deploy
+        run: |
+          command -v ssh-agent >/dev/null || ( apt-get update -y && apt-get install openssh-client -y )
+          eval $(ssh-agent -s)
+          echo "${{ secrets.SSH_PRIVATE_KEY }}" | tr -d '\r' | ssh-add -
+          mkdir -p ~/.ssh
+          chmod 700 ~/.ssh
+          echo "${{ secrets.SSH_KNOWN_HOSTS }}" >> ~/.ssh/known_hosts
+          ssh mdb-deploy@sega.neuf.no "${{ github.sha }}"
diff --git a/.gitea/workflows/prek.yaml b/.gitea/workflows/prek.yaml
new file mode 100644
index 0000000..e65beb8
--- /dev/null
+++ b/.gitea/workflows/prek.yaml
@@ -0,0 +1,14 @@
+name: prek
+
+# The hooks in prek.toml. deploy.yaml calls it before deploying.
+on:
+  push:
+  pull_request:
+  workflow_call:
+
+jobs:
+  prek:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: j178/prek-action@v1
diff --git a/prek.toml b/prek.toml
new file mode 100644
index 0000000..aa62ced
--- /dev/null
+++ b/prek.toml
@@ -0,0 +1,32 @@
+# Git hooks, run by prek (https://prek.j178.dev). `prek install` once per clone; CI runs
+# them all (.gitea/workflows/prek.yaml).
+
+[[repos]]
+repo = "https://github.com/astral-sh/ruff-pre-commit"
+rev = "v0.15.6" # keep in sync with ruff in uv.lock
+hooks = [
+    { id = "ruff-check", args = ["--fix"] },
+    { id = "ruff-format" },
+]
+
+[[repos]]
+repo = "https://github.com/adamchainz/django-upgrade"
+rev = "1.33.0"
+hooks = [{ id = "django-upgrade", args = ["--target-version", "6.0"] }]
+
+[[repos]]
+repo = "https://github.com/pre-commit/pre-commit-hooks"
+rev = "v6.0.0"
+hooks = [
+    { id = "trailing-whitespace" },
+    { id = "end-of-file-fixer" },
+    { id = "check-merge-conflict" },
+    { id = "check-added-large-files" },
+    { id = "check-toml" },
+    { id = "check-yaml" },
+]
+
+[[repos]]
+repo = "https://github.com/astral-sh/uv-pre-commit"
+rev = "0.13.6"
+hooks = [{ id = "uv-lock" }] # uv.lock stays in sync with pyproject.toml