diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..8958b89
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,12 @@
+# Keep secrets, local builds and the web app out of the API image's build context.
+.env*
+**/node_modules
+**/dist
+**/.next
+**/*.tsbuildinfo
+.git
+.turbo
+.idea
+.direnv
+apps/web/*
+!apps/web/package.json
diff --git a/.github/workflows/deploy-api.yml b/.github/workflows/deploy-api.yml
new file mode 100644
index 0000000..009d798
--- /dev/null
+++ b/.github/workflows/deploy-api.yml
@@ -0,0 +1,115 @@
+name: Deploy API
+
+# Runs after "PR checks" passes on a push to main, so nothing deploys that CI
+# has not checked as merged. workflow_run cannot filter by path, so every green
+# merge redeploys: the image is rebuilt from scratch (each runner starts empty)
+# and the migrations are a no-op when there is nothing new.
+# CI runs on main start in merge order (see pr.yml's concurrency), but a pending
+# run is replaced when a newer one queues. So an intermediate merge can end up
+# with no CI run and no deploy of its own; the next merge's deploy includes it.
+# The GCP resources and the three repository variables come from
+# infra/setup-gcp.sh.
+on:
+  workflow_run:
+    workflows: [PR checks]
+    types: [completed]
+    branches: [main]
+  workflow_dispatch:
+
+# One deploy at a time, and never cancel one halfway through a migration. A
+# pending deploy is still replaced by a newer one, which is the one to keep.
+concurrency:
+  group: deploy-api
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  # Lets the job request the OIDC token that Workload Identity Federation trades
+  # for short-lived GCP credentials. There is no service account key anywhere.
+  id-token: write
+
+env:
+  REGION: europe-west1
+  # The commit CI checked, not whatever main points to by now.
+  SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
+  RUNTIME_SA: api-runtime@${{ vars.GCP_PROJECT_ID }}.iam.gserviceaccount.com
+  CLOUDSDK_CORE_PROJECT: ${{ vars.GCP_PROJECT_ID }}
+
+jobs:
+  deploy:
+    # branches: [main] above matches a fork PR whose branch is also called main,
+    # so also require a green push to this repository.
+    if: >-
+      github.event_name == 'workflow_dispatch' || (
+        github.event.workflow_run.conclusion == 'success' &&
+        github.event.workflow_run.event == 'push' &&
+        github.event.workflow_run.head_repository.full_name == github.repository
+      )
+    runs-on: ubuntu-latest
+    env:
+      IMAGE: europe-west1-docker.pkg.dev/${{ vars.GCP_PROJECT_ID }}/api/api:${{ github.event.workflow_run.head_sha || github.sha }}
+    # Actions pinned by commit SHA: this is the only workflow that can get GCP
+    # credentials (id-token: write), and a tag can be moved, a SHA cannot. To
+    # update one: gh api repos/<owner>/<action>/commits/<tag> --jq .sha
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ env.SHA }}
+          persist-credentials: false
+
+      - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
+        with:
+          workload_identity_provider: ${{ vars.GCP_WIF_PROVIDER }}
+          service_account: ${{ vars.GCP_DEPLOYER_SA }}
+
+      - uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1
+
+      - name: Build and push the image
+        run: |
+          gcloud auth configure-docker europe-west1-docker.pkg.dev --quiet
+          docker build -f apps/api/Dockerfile -t "$IMAGE" .
+          docker push "$IMAGE"
+
+      # Runs inside GCP as the runtime account, so the connection string never
+      # passes through this runner. --wait makes the step fail if the migration
+      # fails, which stops the workflow before the new revision is deployed: the
+      # previous one keeps serving.
+      - name: Run migrations
+        run: |
+          gcloud run jobs deploy api-migrate \
+            --region="$REGION" \
+            --image="$IMAGE" \
+            --command=node --args=dist/db/migrate.js \
+            --service-account="$RUNTIME_SA" \
+            --set-secrets=DATABASE_URL=database-url:latest \
+            --max-retries=0 --task-timeout=5m \
+            --execute-now --wait
+
+      # --no-traffic: the new revision only gets the "candidate" URL until its
+      # /health passes below. ^;^ switches gcloud's list separator so the comma
+      # stays inside CORS_ORIGIN.
+      - name: Deploy the new revision without traffic
+        run: |
+          gcloud run deploy api \
+            --region="$REGION" \
+            --image="$IMAGE" \
+            --no-traffic --tag=candidate \
+            --port=4000 \
+            --service-account="$RUNTIME_SA" \
+            --set-secrets=DATABASE_URL=database-url:latest \
+            --set-env-vars="^;^CORS_ORIGIN=https://acmfeup.eu,https://www.acmfeup.eu" \
+            --min-instances=0 --max-instances=2 \
+            --cpu=1 --memory=512Mi \
+            --quiet
+
+      # Retries cover the cold start of the new instance and of Neon's compute.
+      # If this fails, the workflow stops and the previous revision keeps all
+      # the traffic.
+      - name: Check /health on the new revision
+        run: |
+          url="$(gcloud run services describe api --region="$REGION" --format=json \
+            | jq -r '.status.traffic[] | select(.tag == "candidate") | .url')"
+          curl -fsS --retry 5 --retry-all-errors "$url/health"
+
+      - name: Send all traffic to the new revision
+        run: gcloud run services update-traffic api --region="$REGION" --to-latest
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index e97a875..8537432 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -6,7 +6,9 @@ on:
     branches: [main]
 
 # A new push to a PR cancels the run still going for its previous commit.
-# Runs on main are never cancelled, so every merge gets a full result.
+# A run already going on main is never cancelled, but GitHub still replaces a
+# pending run on main when a newer one queues, so a merge in between can end up
+# with no run of its own; the newer run checks its changes too.
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
@@ -91,6 +93,19 @@ jobs:
             exit 1
           fi
 
+  # Builds the production image of the API, without pushing it. The Dockerfile
+  # only copies packages/config and apps/api, so if the API starts depending on
+  # a new package in packages/, this job goes red here instead of the deploy
+  # breaking on main.
+  docker:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - run: docker build -f apps/api/Dockerfile .
+
   gitleaks:
     runs-on: ubuntu-latest
     permissions:
diff --git a/README.md b/README.md
index 5306474..e9a651f 100644
--- a/README.md
+++ b/README.md
@@ -49,6 +49,22 @@ Run these from the repo root.
 
 To run something in one package only: `pnpm --filter @acmfeup/api <script>`.
 
+## Deploy
+
+The web app deploys on Vercel. The API deploys itself: once CI passes on a merge to `main`, [`deploy-api.yml`](.github/workflows/deploy-api.yml)
+
+1. builds `apps/api/Dockerfile` and pushes it to Artifact Registry,
+2. runs the migrations as the `api-migrate` Cloud Run Job and waits for it,
+3. deploys the new image to the `api` Cloud Run service (europe-west1, scales to zero, at most 2 instances) without traffic, checks its `/health`, and only then moves traffic to it.
+
+If the migrations or the health check fail, the workflow stops and the previous version stays live. The database is on Neon (Frankfurt). Its connection string is stored only in Secret Manager (`database-url`): not in the repo, not in GitHub, and it never passes through the GitHub runner. GitHub gets short-lived credentials through Workload Identity Federation, and only for `deploy-api.yml` running on `main`. The code that workflow deploys runs with the connection string, so merging to `main` is as sensitive as holding the string itself.
+
+Vercel preview deployments cannot call the production API: `CORS_ORIGIN` only allows `acmfeup.eu` and `www.acmfeup.eu`. This is on purpose. A preview runs new frontend code, which should not run against the production API and its data, and a `*.vercel.app` pattern would also match other people's projects.
+
+**Migrations run before the new code is live, so they must be backwards compatible with the API version currently running.** For the whole window between them, and after any rollback, the old code runs against the new schema. The rules are in [CONTRIBUTING.md](CONTRIBUTING.md#database-migrations).
+
+The GCP side is created by [`infra/setup-gcp.sh`](infra/setup-gcp.sh). Run it once in Cloud Shell (`bash infra/setup-gcp.sh <PROJECT_ID>`), and set the three repository variables it prints, before the first merge that should deploy; until then the deploy workflow fails at authentication. Running it again is safe, and it is also how you rotate the database password: paste the new connection string when it asks, then run the Deploy API workflow by hand, so that the running instances pick up the new string.
+
 ## Contributing
 
 Read [CONTRIBUTING.md](CONTRIBUTING.md) before opening your first issue or PR. If you work with a coding agent, it should read [AGENTS.md](AGENTS.md).
diff --git a/apps/api/Dockerfile b/apps/api/Dockerfile
new file mode 100644
index 0000000..de5812c
--- /dev/null
+++ b/apps/api/Dockerfile
@@ -0,0 +1,33 @@
+# Production image of the API. Build from the repo root, which has the lockfile
+# and the workspace:
+#   docker build -f apps/api/Dockerfile -t acmfeup-api .
+
+FROM node:24.21.0-slim AS build
+WORKDIR /repo
+# corepack installs the pnpm pinned in packageManager; LEFTHOOK=0 skips git hooks.
+ENV COREPACK_ENABLE_DOWNLOAD_PROMPT=0 LEFTHOOK=0
+RUN corepack enable
+
+# Manifests first, so the install layer is cached until dependencies change.
+# apps/web/package.json is only there because the lockfile lists it.
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+COPY packages/config/package.json packages/config/
+COPY apps/api/package.json apps/api/
+COPY apps/web/package.json apps/web/
+RUN pnpm install --frozen-lockfile --filter @acmfeup/api...
+
+COPY packages/config packages/config
+COPY apps/api apps/api
+RUN pnpm --filter @acmfeup/api build \
+  && pnpm --filter @acmfeup/api deploy --prod --legacy /out
+
+FROM node:24.21.0-slim
+WORKDIR /app
+ENV NODE_ENV=production
+COPY --from=build /out/package.json ./
+COPY --from=build /out/node_modules node_modules
+COPY --from=build /repo/apps/api/dist dist
+COPY --from=build /repo/apps/api/drizzle drizzle
+USER node
+EXPOSE 4000
+CMD ["node", "dist/main.js"]
diff --git a/apps/api/src/db/migrate.ts b/apps/api/src/db/migrate.ts
new file mode 100644
index 0000000..6aa07a8
--- /dev/null
+++ b/apps/api/src/db/migrate.ts
@@ -0,0 +1,14 @@
+import { migrate } from "drizzle-orm/node-postgres/migrator";
+import { db, pool } from "./client";
+
+// Production migrations, run by the api-migrate Cloud Run Job. drizzle-kit is a
+// dev dependency and stays out of the image, so this uses drizzle-orm's own
+// migrator, which drizzle-kit migrate calls under the hood: both record applied
+// migrations in drizzle.__drizzle_migrations. Keep the defaults, or the two stop
+// seeing each other's history. cwd is apps/api locally and /app in the image.
+migrate(db, { migrationsFolder: "drizzle" })
+  .catch((error) => {
+    console.error(error);
+    process.exitCode = 1;
+  })
+  .finally(() => pool.end());
diff --git a/apps/api/src/main.ts b/apps/api/src/main.ts
index a6fe858..353b295 100644
--- a/apps/api/src/main.ts
+++ b/apps/api/src/main.ts
@@ -8,6 +8,9 @@ import { API_PORT } from "./config/env";
 async function bootstrap() {
   const app = await NestFactory.create(AppModule);
   app.enableCors({ origin: parseCorsOrigins(process.env.CORS_ORIGIN) });
+  // Handle SIGTERM: in a container node is PID 1, which ignores it unless a
+  // handler exists, so Cloud Run would SIGKILL mid-request after the grace period.
+  app.enableShutdownHooks();
 
   await app.listen(API_PORT);
   Logger.log(`api listening on http://localhost:${API_PORT}`, "Bootstrap");
diff --git a/infra/setup-gcp.sh b/infra/setup-gcp.sh
new file mode 100755
index 0000000..7dca2e2
--- /dev/null
+++ b/infra/setup-gcp.sh
@@ -0,0 +1,191 @@
+#!/usr/bin/env bash
+# One-time GCP setup for deploying the API to Cloud Run. Run it in Cloud Shell:
+#
+#   bash infra/setup-gcp.sh <PROJECT_ID>
+#
+# Safe to run again: existing resources are left as they are, and IAM bindings
+# are additive. It asks for the Neon connection string without echoing it; press
+# Enter to keep the one already stored. The .github/workflows/deploy-api.yml
+# workflow relies on every name below.
+set -euo pipefail
+
+PROJECT_ID="${1:?usage: bash infra/setup-gcp.sh <PROJECT_ID>}"
+export CLOUDSDK_CORE_PROJECT="$PROJECT_ID"
+
+REGION=europe-west1
+REPO=api            # Artifact Registry repository
+SERVICE=api         # Cloud Run service
+SECRET=database-url # Secret Manager secret with the Neon connection string
+GITHUB_REPO=acmfeup/new-website
+POOL=github
+PROVIDER=github-actions
+RUNTIME_SA="api-runtime@$PROJECT_ID.iam.gserviceaccount.com"
+DEPLOYER_SA="github-deployer@$PROJECT_ID.iam.gserviceaccount.com"
+
+step() { printf '\n==> %s\n' "$*"; }
+# The describe calls are existence checks; their "not found" output is noise.
+exists() { "$@" >/dev/null 2>&1; }
+# A service account created seconds ago is not yet visible to IAM, so binding a
+# role to it fails with "does not exist". Retry for up to a minute; the last
+# attempt shows its error.
+retry() {
+  for _ in 1 2 3 4 5 6; do
+    "$@" 2>/dev/null && return
+    echo "  not visible to IAM yet, retrying in 10s..." >&2
+    sleep 10
+  done
+  "$@"
+}
+
+PROJECT_NUMBER="$(gcloud projects describe "$PROJECT_ID" --format='value(projectNumber)')"
+
+step "Enabling APIs"
+gcloud services enable run.googleapis.com artifactregistry.googleapis.com \
+  secretmanager.googleapis.com iam.googleapis.com iamcredentials.googleapis.com \
+  sts.googleapis.com cloudresourcemanager.googleapis.com
+
+step "Artifact Registry repository '$REPO'"
+if ! exists gcloud artifacts repositories describe "$REPO" --location="$REGION"; then
+  gcloud artifacts repositories create "$REPO" --location="$REGION" \
+    --repository-format=docker --description="API images, pushed by GitHub Actions"
+fi
+# Keep the 10 newest images (enough to roll back) and delete the rest.
+policy="$(mktemp)"
+cat >"$policy" <<'JSON'
+[
+  {"name": "keep-recent", "action": {"type": "Keep"}, "mostRecentVersions": {"keepCount": 10}},
+  {"name": "delete-old", "action": {"type": "Delete"}, "condition": {"tagState": "any"}}
+]
+JSON
+gcloud artifacts repositories set-cleanup-policies "$REPO" --location="$REGION" \
+  --policy="$policy" --no-dry-run >/dev/null
+rm -f "$policy"
+
+step "Secret '$SECRET'"
+if ! exists gcloud secrets describe "$SECRET"; then
+  gcloud secrets create "$SECRET" --replication-policy=user-managed --locations="$REGION"
+fi
+has_version="$(gcloud secrets versions list "$SECRET" --filter='state:ENABLED' --limit=1 --format='value(name)')"
+while true; do
+  prompt="Neon direct connection string"
+  [ -n "$has_version" ] && prompt="$prompt (Enter keeps the current one)"
+  read -rsp "$prompt: " url
+  echo
+  if [ -z "$url" ] && [ -n "$has_version" ]; then
+    echo "Keeping the current version."
+    break
+  fi
+  case "$url" in
+    postgres://* | postgresql://*) ;;
+    *) echo "That does not look like a postgres:// URL. Try again."; continue ;;
+  esac
+  case "$url" in
+    *-pooler.*) echo "That is the pooled host (-pooler). Use the direct connection string."; continue ;;
+  esac
+  printf '%s' "$url" | gcloud secrets versions add "$SECRET" --data-file=- >/dev/null
+  echo "Stored a new version."
+  break
+done
+unset url
+
+step "Service accounts"
+if ! exists gcloud iam service-accounts describe "$RUNTIME_SA"; then
+  gcloud iam service-accounts create api-runtime --display-name="API (Cloud Run runtime)"
+fi
+if ! exists gcloud iam service-accounts describe "$DEPLOYER_SA"; then
+  gcloud iam service-accounts create github-deployer --display-name="GitHub Actions deployer"
+fi
+
+step "Permissions"
+# Runtime: read this one secret, nothing else.
+retry gcloud secrets add-iam-policy-binding "$SECRET" --member="serviceAccount:$RUNTIME_SA" \
+  --role=roles/secretmanager.secretAccessor >/dev/null
+# Deployer: push images to this repository, deploy the service and the
+# migration job, and run them as the runtime account. It has no direct access to
+# the secret, but code it deploys runs with it: whoever controls what this
+# account deploys (the deploy workflow on main) can reach the connection string.
+retry gcloud artifacts repositories add-iam-policy-binding "$REPO" --location="$REGION" \
+  --member="serviceAccount:$DEPLOYER_SA" --role=roles/artifactregistry.writer >/dev/null
+retry gcloud projects add-iam-policy-binding "$PROJECT_ID" --member="serviceAccount:$DEPLOYER_SA" \
+  --role=roles/run.developer --condition=None >/dev/null
+retry gcloud iam service-accounts add-iam-policy-binding "$RUNTIME_SA" \
+  --member="serviceAccount:$DEPLOYER_SA" --role=roles/iam.serviceAccountUser >/dev/null
+
+step "Workload Identity Federation for $GITHUB_REPO"
+# The numeric id, not the name: a deleted repo's name can be taken by someone else.
+repo_id="$(curl -fsS "https://api.github.com/repos/$GITHUB_REPO" | jq -r .id)" || repo_id=""
+if [ -z "$repo_id" ]; then
+  read -rp "Could not look up the GitHub repo id. Enter it (gh api repos/$GITHUB_REPO --jq .id): " repo_id
+fi
+# Only the deploy workflow, running on main of this repo, gets credentials. PRs,
+# forks, other branches and any other workflow on main (say a future
+# pull_request_target one) are rejected before any role is checked.
+condition="assertion.repository_id=='$repo_id' && assertion.ref=='refs/heads/main' && assertion.job_workflow_ref=='$GITHUB_REPO/.github/workflows/deploy-api.yml@refs/heads/main'"
+mapping="google.subject=assertion.sub,attribute.repository_id=assertion.repository_id,attribute.ref=assertion.ref"
+if ! exists gcloud iam workload-identity-pools describe "$POOL" --location=global; then
+  gcloud iam workload-identity-pools create "$POOL" --location=global --display-name="GitHub Actions"
+fi
+if exists gcloud iam workload-identity-pools providers describe "$PROVIDER" \
+  --workload-identity-pool="$POOL" --location=global; then
+  gcloud iam workload-identity-pools providers update-oidc "$PROVIDER" \
+    --workload-identity-pool="$POOL" --location=global \
+    --attribute-mapping="$mapping" --attribute-condition="$condition" >/dev/null
+else
+  gcloud iam workload-identity-pools providers create-oidc "$PROVIDER" \
+    --workload-identity-pool="$POOL" --location=global --display-name="GitHub Actions" \
+    --issuer-uri=https://token.actions.githubusercontent.com \
+    --attribute-mapping="$mapping" --attribute-condition="$condition"
+fi
+retry gcloud iam service-accounts add-iam-policy-binding "$DEPLOYER_SA" \
+  --role=roles/iam.workloadIdentityUser \
+  --member="principalSet://iam.googleapis.com/projects/$PROJECT_NUMBER/locations/global/workloadIdentityPools/$POOL/attribute.repository_id/$repo_id" \
+  >/dev/null
+
+step "Cloud Run service '$SERVICE'"
+# Created here with a placeholder image so that making it public stays a human
+# decision: the deployer can deploy new revisions but not change who can call them.
+if ! exists gcloud run services describe "$SERVICE" --region="$REGION"; then
+  gcloud run deploy "$SERVICE" --region="$REGION" \
+    --image=us-docker.pkg.dev/cloudrun/container/hello \
+    --service-account="$RUNTIME_SA" --no-allow-unauthenticated \
+    --min-instances=0 --max-instances=1
+fi
+# Public by turning off Cloud Run's invoker check, not by granting run.invoker
+# to allUsers: the acmfeup.eu organisation forbids allUsers bindings ("Domain
+# restricted sharing"), and this setting only affects this one service. The
+# site calls the API from visitors' browsers, so it has to be public.
+invoker_disabled="$(gcloud run services describe "$SERVICE" --region="$REGION" \
+  --format='value(metadata.annotations."run.googleapis.com/invoker-iam-disabled")')"
+if [ "$invoker_disabled" != "true" ]; then
+  if ! err="$(gcloud run services update "$SERVICE" --region="$REGION" \
+    --no-invoker-iam-check 2>&1 >/dev/null)"; then
+    if grep -qi 'requireInvokerIam' <<<"$err"; then
+      cat >&2 <<EOF
+
+The API could not be made public: the organisation policy
+run.managed.requireInvokerIam forbids turning off Cloud Run's invoker check.
+Someone with Organization Policy Administrator on the organisation has to turn
+that policy off for this project, then run this script again.
+EOF
+    else
+      echo "$err" >&2
+    fi
+    exit 1
+  fi
+fi
+
+url="$(gcloud run services describe "$SERVICE" --region="$REGION" --format='value(status.url)')"
+
+cat <<EOF
+
+Done. Add these as GitHub Actions *variables* (Settings > Secrets and variables >
+Actions > Variables), not secrets:
+
+  GCP_PROJECT_ID    = $PROJECT_ID
+  GCP_WIF_PROVIDER  = projects/$PROJECT_NUMBER/locations/global/workloadIdentityPools/$POOL/providers/$PROVIDER
+  GCP_DEPLOYER_SA   = $DEPLOYER_SA
+
+API URL, for NEXT_PUBLIC_API_URL on Vercel:
+
+  $url
+EOF