diff --git a/.gitea/workflows/docker-build.yml b/.gitea/workflows/docker-build.yml
new file mode 100644
index 0000000..2a59a87
--- /dev/null
+++ b/.gitea/workflows/docker-build.yml
@@ -0,0 +1,62 @@
+name: Build & Push Docker Image to Gitea Registry
+
+on:
+  push:
+    branches: [main]
+
+env:
+  REGISTRY: git.mischlabs.de
+  REGISTRY_USER: MrDiderot
+  REGISTRY_IMAGE: git.mischlabs.de/mrdiderot/crm
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install Docker CLI
+        shell: sh
+        run: |
+          if ! command -v docker >/dev/null 2>&1; then
+            echo "Docker CLI not found. Installing static binary..."
+            if command -v curl >/dev/null 2>&1; then
+              curl -fsSL https://download.docker.com/linux/static/stable/x86_64/docker-26.1.4.tgz | tar -xz -C /usr/local/bin --strip-components=1 docker/docker
+            elif command -v wget >/dev/null 2>&1; then
+              wget -qO- https://download.docker.com/linux/static/stable/x86_64/docker-26.1.4.tgz | tar -xz -C /usr/local/bin --strip-components=1 docker/docker
+            else
+              echo "Neither curl nor wget found! Attempting package manager install..."
+              if command -v apt-get >/dev/null 2>&1; then
+                apt-get update && apt-get install -y docker.io
+              elif command -v apk >/dev/null 2>&1; then
+                apk add --no-cache docker-cli
+              else
+                echo "Cannot install Docker CLI!"
+                exit 1
+              fi
+            fi
+          else
+            echo "Docker CLI already installed."
+          fi
+          docker --version
+
+      - name: Log in to Gitea Package Registry
+        shell: sh
+        run: |
+          if [ -z "${{ secrets.REGISTRY_TOKEN }}" ]; then
+            echo "Missing REGISTRY_TOKEN secret."
+            echo "Create a Gitea personal access token for MrDiderot with package Read and Write permission."
+            exit 1
+          fi
+          echo "${{ secrets.REGISTRY_TOKEN }}" | docker login "${{ env.REGISTRY }}" -u "${{ env.REGISTRY_USER }}" --password-stdin
+
+      - name: Build and push Docker image
+        shell: sh
+        run: |
+          docker build \
+            -t ${{ env.REGISTRY_IMAGE }}:latest \
+            -t ${{ env.REGISTRY_IMAGE }}:${{ github.sha }} \
+            .
+          docker push ${{ env.REGISTRY_IMAGE }}:latest
+          docker push ${{ env.REGISTRY_IMAGE }}:${{ github.sha }}
diff --git a/Dockerfile b/Dockerfile
index 0823a0d..7b9edd1 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -5,10 +5,10 @@ FROM node:18-alpine
 WORKDIR /app
 
 # Copy package descriptors first to leverage Docker layer caching
-COPY package.json ./
+COPY package*.json ./
 
 # Install production dependencies only
-RUN npm install --omit=dev
+RUN npm ci --omit=dev
 
 # Copy server code and public assets
 COPY server.js ./
diff --git a/README.md b/README.md
index ca6b563..b6d6c2a 100644
--- a/README.md
+++ b/README.md
@@ -108,3 +108,32 @@ Auf der Suche nach neuen Abenteuern.
 *   **Backend**: Node.js, Express.js, SQLite (`sqlite3`)
 *   **Frontend**: Vanilla HTML5, CSS3 (luxuriöse HSL-Variablen, Backdrop-Filter), Vanilla JavaScript (SPA, state-driven rendering)
 *   **Icons**: Lucide Icons (per CDN geladen)
+
+---
+
+## Gitea Registry Deployment auf MischNAS
+
+MischCRM soll auf der NAS nicht lokal gebaut werden. Der Build laeuft in Gitea Actions und pusht das fertige Image in die lokale Gitea Container Registry:
+
+```text
+git.mischlabs.de/mrdiderot/crm:latest
+```
+
+Die NAS zieht dieses Image per Docker Compose. Der universelle Watchtower kann es danach regelmaessig pruefen und bei neuen Images automatisch aktualisieren.
+
+### Start und manuelles Update auf der NAS
+
+```bash
+cd /volume2/docker/mischcrm
+git pull --ff-only
+docker compose pull
+docker compose up -d
+```
+
+Falls `docker compose up -d` lokal zu bauen beginnt, steht in der Compose noch `build:` statt `image:`. Korrekt ist:
+
+```yaml
+image: git.mischlabs.de/mrdiderot/crm:latest
+```
+
+Die SQLite-Daten bleiben ueber `./data:/app/data` persistent. Die Datei `./data/crm.db` darf nicht ins Git committed werden.
diff --git a/docker-compose.yml b/docker-compose.yml
index 9cda9d6..bf44386 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,11 +1,7 @@
-version: '3.8'
-
 services:
   mischcrm:
     container_name: mischcrm
-    build:
-      context: .
-      dockerfile: Dockerfile
+    image: git.mischlabs.de/mrdiderot/crm:latest
     restart: unless-stopped
     ports:
       - '38090:8085'