diff --git a/deploy.sh b/deploy.sh
new file mode 100755
index 0000000..b45080d
--- /dev/null
+++ b/deploy.sh
@@ -0,0 +1,35 @@
+#!/bin/bash
+# Deploy latest kiosk code to the production kiosk
+# Usage: ./deploy.sh ["commit message"]
+set -e
+
+KIOSK_LOCAL="jgitta@192.168.88.44"
+KIOSK_REMOTE="jgitta@100.64.0.1"
+REPO_DIR="$(cd "$(dirname "$0")" && pwd)"
+COMMIT_MSG="${1:-deploy: update from kiosk-dev $(date +%Y-%m-%d)}"
+
+echo "==> Committing and pushing to Gitea..."
+git -C "$REPO_DIR" add -A
+git -C "$REPO_DIR" commit -m "$COMMIT_MSG" 2>/dev/null || echo "  (nothing new to commit)"
+git -C "$REPO_DIR" push origin master || echo "  (nothing new to push)"
+
+echo "==> Deploying to production kiosk..."
+KIOSK=""
+if ssh -o ConnectTimeout=5 -o BatchMode=yes $KIOSK_LOCAL "echo ok" &>/dev/null; then
+  KIOSK="$KIOSK_LOCAL"
+  echo "  Reaching kiosk via local network"
+elif ssh -o ConnectTimeout=8 -o BatchMode=yes $KIOSK_REMOTE "echo ok" &>/dev/null; then
+  KIOSK="$KIOSK_REMOTE"
+  echo "  Reaching kiosk via Tailscale"
+else
+  echo "ERROR: Cannot reach kiosk on local or Tailscale"
+  exit 1
+fi
+
+ssh "$KIOSK" "
+  cd /home/jgitta/kiosk-browser
+  git pull
+  /usr/local/bin/kiosk-restart
+"
+
+echo "==> Deploy complete!"