diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml
index 1374077..e2dce5e 100644
--- a/.gitea/workflows/deploy.yaml
+++ b/.gitea/workflows/deploy.yaml
@@ -1,13 +1,18 @@
-name: Deploy (manual)
+name: Deploy
 
-# 배포 대상이 정해지면 아래 단계의 주석을 풀고 시크릿을 등록하세요.
-# 저장소 Settings > Actions > Secrets 에 등록 필요(예시):
-#   DEPLOY_HOST, DEPLOY_USER, DEPLOY_SSH_KEY, DEPLOY_PATH
-#   (운영 DB/Redis 접속정보는 서버의 .env 또는 환경변수로 관리)
+# main 푸시 시 자동 배포: jar 빌드 → 서버로 scp → systemd 재시작
+#
+# 저장소 Settings > Actions > Secrets 에 등록:
+#   DEPLOY_HOST     배포 서버 호스트/IP
+#   DEPLOY_USER     SSH 계정 (systemctl 무비밀번호 sudo 필요 — deploy/README.md 참고)
+#   DEPLOY_SSH_KEY  SSH 개인키 (PEM 전체)
+#   DEPLOY_PATH     jar 배치 디렉터리 (예: /opt/sb-backend)
+#   DEPLOY_PORT     SSH 포트 (선택, 기본 22)
+#   SERVICE_NAME    systemd 유닛명 (선택, 기본 sb-backend)
 on:
+  push:
+    branches: [main]
   workflow_dispatch: {}
-  # push:
-  #   tags: ['v*']
 
 jobs:
   deploy:
@@ -28,30 +33,33 @@ jobs:
           chmod +x ./gradlew
           ./gradlew --no-daemon clean bootJar -x test
 
-      # ===== 배포 예시 (택1) — 사용 시 주석 해제 =====
-      # 1) jar 를 원격 서버로 전송 후 서비스 재시작
-      # - name: Copy jar to server
-      #   uses: appleboy/scp-action@v0.1.7
-      #   with:
-      #     host: ${{ secrets.DEPLOY_HOST }}
-      #     username: ${{ secrets.DEPLOY_USER }}
-      #     key: ${{ secrets.DEPLOY_SSH_KEY }}
-      #     source: "build/libs/*.jar"
-      #     target: ${{ secrets.DEPLOY_PATH }}
-      #     strip_components: 2
-      # - name: Restart service
-      #   uses: appleboy/ssh-action@v1.0.3
-      #   with:
-      #     host: ${{ secrets.DEPLOY_HOST }}
-      #     username: ${{ secrets.DEPLOY_USER }}
-      #     key: ${{ secrets.DEPLOY_SSH_KEY }}
-      #     script: sudo systemctl restart sb-backend
+      - name: Deploy (SSH + systemd)
+        env:
+          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
+          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
+          DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
+          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+          DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
+          SERVICE_NAME: ${{ secrets.SERVICE_NAME }}
+        run: |
+          set -euo pipefail
+          PORT="${DEPLOY_PORT:-22}"
+          SERVICE="${SERVICE_NAME:-sb-backend}"
+          DEST="${DEPLOY_PATH:-}"
+          if [ -z "$DEST" ] || [ "$DEST" = "/" ]; then
+            echo "::error::DEPLOY_PATH 시크릿이 비어 있거나 잘못되었습니다."; exit 1
+          fi
 
-      # 2) (대안) Docker 이미지 빌드 후 레지스트리 푸시
-      # - name: Build & push image
-      #   run: |
-      #     docker build -t ${{ secrets.REGISTRY }}/sb-backend:${{ github.sha }} .
-      #     docker push ${{ secrets.REGISTRY }}/sb-backend:${{ github.sha }}
+          mkdir -p ~/.ssh && chmod 700 ~/.ssh
+          printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/id_deploy
+          chmod 600 ~/.ssh/id_deploy
+          ssh-keyscan -p "$PORT" "$DEPLOY_HOST" >> ~/.ssh/known_hosts 2>/dev/null
+          SSH="ssh -p $PORT -i $HOME/.ssh/id_deploy -o StrictHostKeyChecking=yes"
 
-      - name: Notice
-        run: echo "jar 빌드 완료. 배포 대상 지정 후 위 단계를 활성화하세요."
+          JAR=$(ls build/libs/*.jar | grep -v -- '-plain.jar' | head -n1)
+          echo "Deploy $JAR -> $DEPLOY_USER@$DEPLOY_HOST:$DEST/app.jar"
+
+          $SSH "$DEPLOY_USER@$DEPLOY_HOST" "mkdir -p '$DEST'"
+          scp -P "$PORT" -i "$HOME/.ssh/id_deploy" "$JAR" "$DEPLOY_USER@$DEPLOY_HOST:$DEST/app.jar"
+          $SSH "$DEPLOY_USER@$DEPLOY_HOST" "sudo systemctl restart '$SERVICE' && sleep 3 && sudo systemctl is-active '$SERVICE'"
+          echo "✅ 배포 완료"
diff --git a/deploy/README.md b/deploy/README.md
new file mode 100644
index 0000000..346ac4e
--- /dev/null
+++ b/deploy/README.md
@@ -0,0 +1,48 @@
+# 백엔드 배포 (SSH + systemd)
+
+`main` 푸시 시 [.gitea/workflows/deploy.yaml](../.gitea/workflows/deploy.yaml) 가
+jar 를 빌드해 서버로 전송하고 systemd 서비스를 재시작합니다.
+
+## 1. Gitea 저장소 시크릿 (Settings → Actions → Secrets)
+| 시크릿 | 설명 | 예시 |
+|---|---|---|
+| `DEPLOY_HOST` | 서버 호스트/IP | `10.0.0.5` |
+| `DEPLOY_USER` | SSH 계정 | `deploy` |
+| `DEPLOY_SSH_KEY` | SSH 개인키(PEM 전체) | `-----BEGIN OPENSSH PRIVATE KEY-----...` |
+| `DEPLOY_PATH` | jar 배치 경로 | `/opt/sb-backend` |
+| `DEPLOY_PORT` | SSH 포트(선택) | `22` |
+| `SERVICE_NAME` | systemd 유닛명(선택) | `sb-backend` |
+
+## 2. 서버 1회 준비
+```bash
+# 자바 17, 배포 계정/디렉터리
+sudo apt-get install -y openjdk-17-jre-headless
+sudo useradd -m -s /bin/bash deploy   # 이미 있으면 생략
+sudo mkdir -p /opt/sb-backend && sudo chown deploy:deploy /opt/sb-backend
+
+# 러너가 보낸 공개키를 deploy 계정에 등록
+sudo -u deploy mkdir -p /home/deploy/.ssh
+echo "<배포용 공개키>" | sudo -u deploy tee -a /home/deploy/.ssh/authorized_keys
+
+# 운영 환경변수 (.env, git 미추적) — DB/Redis 접속정보
+sudo -u deploy tee /opt/sb-backend/.env >/dev/null <<'EOF'
+DB_URL=jdbc:mariadb://localhost:3306/sb_db?useUnicode=true&characterEncoding=UTF-8&serverTimezone=Asia/Seoul
+DB_USERNAME=sb
+DB_PASSWORD=changeme
+REDIS_HOST=localhost
+REDIS_PORT=6379
+EOF
+
+# systemd 유닛 설치
+sudo cp deploy/sb-backend.service /etc/systemd/system/sb-backend.service
+sudo systemctl daemon-reload
+sudo systemctl enable --now sb-backend
+
+# deploy 계정에 해당 서비스 재시작 무비밀번호 sudo 허용
+echo 'deploy ALL=(root) NOPASSWD: /bin/systemctl restart sb-backend, /bin/systemctl is-active sb-backend' \
+  | sudo tee /etc/sudoers.d/sb-backend
+```
+
+## 3. 동작
+- main 푸시 → CI(빌드·테스트) + Deploy(빌드·전송·재시작) 가 각각 실행
+- 수동 배포: 저장소 Actions → Deploy → Run workflow
diff --git a/deploy/sb-backend.service b/deploy/sb-backend.service
new file mode 100644
index 0000000..c75805a
--- /dev/null
+++ b/deploy/sb-backend.service
@@ -0,0 +1,18 @@
+[Unit]
+Description=SB Backend (Spring Boot)
+After=network.target mariadb.service redis-server.service
+
+[Service]
+Type=simple
+User=deploy
+WorkingDirectory=/opt/sb-backend
+# WorkingDirectory 의 .env(properties 형식)를 Spring 이 자동 로드 (application.yml 의 config.import)
+# 또는 아래처럼 systemd 로 주입해도 됨:
+# EnvironmentFile=/opt/sb-backend/.env
+ExecStart=/usr/bin/java -jar /opt/sb-backend/app.jar
+SuccessExitStatus=143
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target