diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
new file mode 100644
index 0000000..b171c56
--- /dev/null
+++ b/.gitea/workflows/build.yml
@@ -0,0 +1,81 @@
+name: Build and Publish dsh image
+run-name: Сборка образа dsh (${{ gitea.actor }})
+
+on:
+  push:
+    branches: [master, main]
+    paths:
+      - 'upstream/**'
+      - '.gitea/workflows/build.yml'
+  workflow_dispatch:
+    inputs:
+      dsh_version:
+        description: 'Версия @deepseek-ai/dsh (пусто = npm dist-tag latest)'
+        required: false
+        default: ''
+
+concurrency:
+  group: dsh-image-build
+  cancel-in-progress: false
+
+jobs:
+  build:
+    name: Build, smoke-test, publish
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Resolve DSH version
+        id: ver
+        run: |
+          VERSION="${{ gitea.event.inputs.dsh_version }}"
+          if [ -z "$VERSION" ]; then
+            VERSION=$(curl -fsS https://registry.npmjs.org/-/package/@deepseek-ai%2Fdsh/dist-tags \
+              | sed -n 's/.*"latest":"\([^"]*\)".*/\1/p')
+          fi
+          [ -n "$VERSION" ] || { echo "не удалось определить версию" >&2; exit 1; }
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "Версия dsh: $VERSION"
+
+      - name: Build image
+        env:
+          VERSION: ${{ steps.ver.outputs.version }}
+        run: |
+          DOCKER_BUILDKIT=1 docker build \
+            --build-arg DSH_VERSION="$VERSION" \
+            -t gitea.archeon.io/archeon/dsh:"$VERSION" \
+            -t gitea.archeon.io/archeon/dsh:latest \
+            upstream/
+
+      - name: Smoke test (container health + version)
+        env:
+          VERSION: ${{ steps.ver.outputs.version }}
+        run: |
+          docker run -d --name dsh-smoke gitea.archeon.io/archeon/dsh:"$VERSION"
+          STATUS=unknown
+          for i in $(seq 1 36); do
+            STATUS=$(docker inspect -f '{{.State.Health.Status}}' dsh-smoke 2>/dev/null || echo missing)
+            echo "[$i] health: $STATUS"
+            [ "$STATUS" = "healthy" ] && break
+            sleep 5
+          done
+          docker logs dsh-smoke 2>&1 | tail -5 || true
+          if [ "$STATUS" != "healthy" ]; then
+            docker rm -f dsh-smoke || true
+            echo "Контейнер не стал healthy" >&2
+            exit 1
+          fi
+          echo "Версия в контейнере: $(docker exec dsh-smoke dsh --version)"
+          docker rm -f dsh-smoke
+
+      - name: Login to gitea.archeon.io registry
+        run: echo "${{ secrets.GITEA_BOT_TOKEN }}" | docker login gitea.archeon.io -u hermes --password-stdin
+
+      - name: Push images
+        env:
+          VERSION: ${{ steps.ver.outputs.version }}
+        run: |
+          docker push gitea.archeon.io/archeon/dsh:"$VERSION"
+          docker push gitea.archeon.io/archeon/dsh:latest