diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml
index 726e4b2..cda3dbb 100644
--- a/.gitea/workflows/build.yaml
+++ b/.gitea/workflows/build.yaml
@@ -22,6 +22,23 @@ jobs:
           docker build -f docker/Dockerfile.bot       -t gitea.czernobog.pl/gitea/conjurer-bot:$TAG .
           docker push  gitea.czernobog.pl/gitea/conjurer-bot:$TAG
 
+      # DEPLOY channel: the production (deploy) bot tracks a SEPARATE image,
+      # conjurer-bot-deploy, which only gets a new tag when the commit message
+      # contains the trigger "[deploy]". So the test bot & librarian update on
+      # every build, but the deploy bot only on commits you explicitly promote.
+      # Same bytes as conjurer-bot:$TAG - just re-tagged, no rebuild.
+      - name: Promote bot to deploy channel (only on [deploy] in commit message)
+        run: |
+          TAG=${GITHUB_SHA::8}
+          MSG="$(git log -1 --pretty=%B)"
+          if echo "$MSG" | grep -qiF '[deploy]'; then
+            echo "Commit message contains [deploy] -> promoting conjurer-bot-deploy:$TAG"
+            docker tag  gitea.czernobog.pl/gitea/conjurer-bot:$TAG gitea.czernobog.pl/gitea/conjurer-bot-deploy:$TAG
+            docker push gitea.czernobog.pl/gitea/conjurer-bot-deploy:$TAG
+          else
+            echo "No [deploy] trigger in commit message -> deploy bot image left unchanged"
+          fi
+
       # Docker-owe: musician i share lekkie, radio CIĘŻKIE (opam+OCaml+liquidsoap)
       - name: Build docker-stack images (musician, share)
         run: |