diff --git a/.env.staging.example b/.env.staging.example
new file mode 100644
index 0000000..a09c141
--- /dev/null
+++ b/.env.staging.example
@@ -0,0 +1,34 @@
+# Staging environment variables
+# Copy to .env.staging and fill in values
+
+# Database password for the staging Postgres container
+STAGING_DB_PASSWORD=""
+
+# Root admin email (auto-promoted to admin on login)
+ROOT_ADMIN_EMAIL=""
+
+# Better Auth — must be different from production!
+# Generate: openssl rand -hex 16
+BETTER_AUTH_SECRET=""
+
+# osu! OAuth — separate app from production
+# Register at https://osu.ppy.sh/home/account/edit
+# Callback URL: https://staging.esports.vash.software/api/auth/oauth2/callback/osu
+OSU_CLIENT_ID=""
+OSU_CLIENT_SECRET=""
+
+# osu! IRC — separate account from production to avoid conflicts
+# Get credentials at https://osu.ppy.sh/p/irc
+OSU_IRC_USERNAME=""
+OSU_IRC_PASSWORD=""
+
+# Discord — optional, use a staging channel or leave blank to disable
+DISCORD_BOT_TOKEN=""
+DISCORD_MATCH_CHANNEL_ID=""
+
+# Cloudflare R2 — can share with production (read-only image cache)
+R2_ACCOUNT_ID=""
+R2_ACCESS_KEY_ID=""
+R2_SECRET_ACCESS_KEY=""
+R2_BUCKET="vash-esports-images"
+R2_PUBLIC_URL="https://cdn.esports.vash.software"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..ed614f9
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,33 @@
+name: CI
+
+on:
+  push:
+    branches: [dev, staging, prod]
+  pull_request:
+    branches: [dev, staging, prod]
+
+jobs:
+  ci:
+    name: Lint, Check & Build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Lint
+        run: bun run lint
+
+      - name: Type check
+        run: bun run check
+
+      - name: Build
+        run: bun run build
+
+      - name: Tests
+        run: bun test
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
new file mode 100644
index 0000000..dd099be
--- /dev/null
+++ b/.github/workflows/deploy.yml
@@ -0,0 +1,44 @@
+name: Deploy
+
+on:
+  push:
+    branches: [staging, prod]
+
+jobs:
+  deploy:
+    name: Deploy to ${{ github.ref_name }}
+    runs-on: ubuntu-latest
+    environment: ${{ github.ref_name == 'prod' && 'production' || 'staging' }}
+    concurrency:
+      group: deploy-${{ github.ref_name }}
+      cancel-in-progress: false
+    steps:
+      - name: Deploy via SSH
+        uses: appleboy/ssh-action@v1
+        with:
+          host: ${{ secrets.DEPLOY_HOST }}
+          username: ${{ secrets.DEPLOY_USER }}
+          key: ${{ secrets.DEPLOY_SSH_KEY }}
+          script_stop: true
+          script: |
+            set -euo pipefail
+
+            if [ "${{ github.ref_name }}" = "prod" ]; then
+              cd /opt/esports
+              git fetch origin prod
+              git checkout prod
+              git reset --hard origin/prod
+
+              docker compose build
+              docker compose up -d
+              docker compose exec app bun run db:push
+            else
+              cd /opt/esports-staging
+              git fetch origin staging
+              git checkout staging
+              git reset --hard origin/staging
+
+              docker compose -f docker-compose.staging.yml --env-file .env.staging -p esports-staging build
+              docker compose -f docker-compose.staging.yml --env-file .env.staging -p esports-staging up -d
+              docker compose -f docker-compose.staging.yml --env-file .env.staging -p esports-staging exec staging-app bun run db:push
+            fi
diff --git a/.gitignore b/.gitignore
index 41f1bdc..bede11a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -16,6 +16,7 @@ Thumbs.db
 .env
 .env.*
 !.env.example
+!.env.staging.example
 !.env.test
 
 # Vite
diff --git a/package.json b/package.json
index 8b34fa8..5883295 100644
--- a/package.json
+++ b/package.json
@@ -14,7 +14,7 @@
 		"lint": "prettier --check . && eslint .",
 		"format": "prettier --write .",
 		"test:unit": "vitest",
-		"test": "npm run test:unit -- --run && npm run test:e2e",
+		"test": "bun run test:unit -- --run && bun run test:e2e",
 		"test:e2e": "playwright test",
 		"db:push": "drizzle-kit push",
 		"db:generate": "drizzle-kit generate",
diff --git a/playwright.config.ts b/playwright.config.ts
index 8f5062c..7e45567 100644
--- a/playwright.config.ts
+++ b/playwright.config.ts
@@ -1,6 +1,6 @@
 import { defineConfig } from '@playwright/test';
 
 export default defineConfig({
-	webServer: { command: 'npm run build && npm run preview', port: 4173 },
+	webServer: { command: 'bun run build && bun run preview', port: 4173 },
 	testDir: 'e2e'
 });