diff --git a/.env.example b/.env.example
index 49682ec..9ba8c93 100644
--- a/.env.example
+++ b/.env.example
@@ -1,6 +1,13 @@
 # ─── UOMysticmoon — root environment (used by docker-compose) ───
 # Copy to .env and fill in. NEVER commit the real .env.
 
+# Container image tag pulled by docker-compose (app + bot). Published by the
+# Gitea Actions workflow on every merge to main as `latest` and `sha-<7>`.
+# Leave as `latest` for routine deploys; pin to a specific build for a
+# reproducible deploy or rollback, e.g. IMAGE_TAG=sha-042a151.
+# Deploy: `docker compose pull && docker compose up -d`.
+IMAGE_TAG=latest
+
 # App
 NODE_ENV=production
 PORT=3000
diff --git a/README.md b/README.md
index e002f51..d52bcee 100644
--- a/README.md
+++ b/README.md
@@ -111,6 +111,20 @@ docker compose up -d --build
 - Logs: `docker compose logs -f app` (and `./logs/app.log` on the host)
 - Stop: `docker compose down` (add `-v` to also wipe the database + uploads volumes)
 
+**Deploy prebuilt images (no local build).** Every merge to `main` publishes the
+`app` and `bot` images to the Gitea container registry
+(`.gitea/workflows/build-images.yml`), so on the server you can pull instead of
+building:
+
+```bash
+docker compose pull && docker compose up -d          # IMAGE_TAG defaults to `latest`
+# pin a specific build (reproducible deploy / rollback):
+IMAGE_TAG=sha-042a151 docker compose pull && docker compose up -d
+```
+
+`build:` is kept in `docker-compose.yml`, so `docker compose up -d --build` still
+works if you'd rather build locally.
+
 ### Option B — Local development (hot reload)
 
 Run the API and the Vite dev server separately. The Vite server proxies `/api` and `/uploads`
diff --git a/docker-compose.yml b/docker-compose.yml
index 21cd14b..da4f146 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -21,6 +21,13 @@ services:
     #   - "3306:3306"
 
   app:
+    # Pull the prebuilt image from the Gitea registry (published by
+    # .gitea/workflows/build-images.yml on every merge to main). `build:` is kept
+    # so a local `docker compose build`/`up --build` still works; on the server,
+    # `docker compose pull && up -d` uses the registry image and never builds.
+    # IMAGE_TAG defaults to `latest`; pin a specific build for reproducible
+    # deploys / rollback, e.g. IMAGE_TAG=sha-042a151 (see .env / .env.example).
+    image: gitea.whitlocktech.com/uom/website-app:${IMAGE_TAG:-latest}
     build: .
     restart: unless-stopped
     env_file: .env
@@ -44,6 +51,8 @@ services:
       - "3000:3000"
 
   bot:
+    # Same as app: pull the prebuilt bot image; IMAGE_TAG pins the build.
+    image: gitea.whitlocktech.com/uom/website-bot:${IMAGE_TAG:-latest}
     build:
       context: .
       dockerfile: bot/Dockerfile