diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 49e3402..6e49530 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -1,37 +1,68 @@
-name: Deploy im-manager (k3s test cluster)
+name: Deploy im-manager production
 
 on:
+  push:
+    branches:
+      - pro
   workflow_dispatch:
-    inputs:
-      image_tag:
-        description: '镜像tag，默认为 test（与集群 kustomization 里的 newTag 一致）'
-        required: false
+
+concurrency:
+  group: production-im-manager
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+env:
+  REGISTRY: git.olns.shop
+  IMAGE: git.olns.shop/pro/im_manager
+  SERVICE: im-manager
+  DEPLOY_HOST: 145.223.69.9
+  DEPLOY_USER: olns-deploy
 
 jobs:
   deploy:
     runs-on: deploy-host
+    timeout-minutes: 60
     steps:
       - uses: actions/checkout@v4
 
-      - name: 确定镜像tag
-        id: vars
+      - name: Log in to Gitea Container Registry
+        env:
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
-          TAG="${{ github.event.inputs.image_tag }}"
-          [ -z "$TAG" ] && TAG=test
-          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+          set -euo pipefail
+          printf '%s' "$REGISTRY_TOKEN" | docker login "$REGISTRY" -u admin --password-stdin
 
-      - name: 登录镜像仓库
-        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.118im.com -u admin --password-stdin
-
-      - name: 构建并推送镜像(前端+后端一体，自包含多阶段构建)
+      - name: Build and push image
+        env:
+          GITHUB_SHA: ${{ github.sha }}
         run: |
-          docker build -t git.118im.com/im_team/im-manager:${{ steps.vars.outputs.tag }} .
-          docker push git.118im.com/im_team/im-manager:${{ steps.vars.outputs.tag }}
+          set -euo pipefail
+          SHORT_SHA="$(printf '%.12s' "$GITHUB_SHA")"
+          docker build -t "${IMAGE}:pro" -t "${IMAGE}:${SHORT_SHA}" .
+          docker push "$IMAGE:pro"
+          docker push "$IMAGE:$SHORT_SHA"
 
-      - name: 部署到k3s测试集群
+      - name: Deploy Compose service
+        env:
+          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+          DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
-          mkdir -p ~/.kube
-          echo "${{ secrets.KUBECONFIG }}" > ~/.kube/config
-          chmod 600 ~/.kube/config
-          kubectl rollout restart deployment/im-manager -n manager-system
-          kubectl rollout status deployment/im-manager -n manager-system --timeout=120s
+          set -euo pipefail
+          install -d -m 700 "$HOME/.ssh"
+          KEY_FILE="$(mktemp "$HOME/.ssh/olns-deploy.XXXXXX")"
+          cleanup() {
+            shred -u "$KEY_FILE" 2>/dev/null || true
+          }
+          trap cleanup EXIT
+          printf '%s\n' "$DEPLOY_SSH_KEY" > "$KEY_FILE"
+          chmod 600 "$KEY_FILE"
+          printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > "$HOME/.ssh/known_hosts"
+          chmod 600 "$HOME/.ssh/known_hosts"
+          SSH_ARGS=(-i "$KEY_FILE" -o BatchMode=yes -o StrictHostKeyChecking=yes)
+          printf '%s' "$REGISTRY_TOKEN" | ssh "${SSH_ARGS[@]}" "$DEPLOY_USER@$DEPLOY_HOST" \
+            "docker login git.olns.shop -u admin --password-stdin"
+          ssh "${SSH_ARGS[@]}" "$DEPLOY_USER@$DEPLOY_HOST" \
+            "cd /opt/olns && docker compose pull im-manager && docker compose up -d --no-deps --wait im-manager"
diff --git a/tests/test_actions_workflow.py b/tests/test_actions_workflow.py
new file mode 100644
index 0000000..99b458d
--- /dev/null
+++ b/tests/test_actions_workflow.py
@@ -0,0 +1,39 @@
+from pathlib import Path
+import unittest
+
+
+WORKFLOW = Path(__file__).resolve().parents[1] / ".gitea/workflows/deploy.yml"
+
+
+class DeployWorkflowContractTest(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.workflow = WORKFLOW.read_text(encoding="utf-8")
+
+    def test_targets_pro_branch_and_single_runner(self):
+        self.assertIn("push:", self.workflow)
+        self.assertIn("- pro", self.workflow)
+        self.assertIn("workflow_dispatch:", self.workflow)
+        self.assertIn("runs-on: deploy-host", self.workflow)
+        self.assertIn("concurrency:", self.workflow)
+
+    def test_builds_and_pushes_pro_image(self):
+        self.assertIn("git.olns.shop/pro/im_manager", self.workflow)
+        self.assertIn("docker push", self.workflow)
+        self.assertIn(":pro", self.workflow)
+
+    def test_deploys_compose_service_with_pinned_host_key(self):
+        self.assertIn("DEPLOY_SSH_KEY", self.workflow)
+        self.assertIn("DEPLOY_KNOWN_HOSTS", self.workflow)
+        self.assertIn("StrictHostKeyChecking=yes", self.workflow)
+        self.assertIn("docker compose pull im-manager", self.workflow)
+        self.assertIn("docker compose up -d --no-deps --wait im-manager", self.workflow)
+
+    def test_removes_old_kubernetes_and_registry_targets(self):
+        self.assertNotIn("kubectl", self.workflow)
+        self.assertNotIn("KUBECONFIG", self.workflow)
+        self.assertNotIn("git.118im.com", self.workflow)
+
+if __name__ == "__main__":
+    unittest.main()
+