diff --git a/.env.example b/.env.example
index 9fa2ff9..930af5b 100644
--- a/.env.example
+++ b/.env.example
@@ -50,3 +50,6 @@ DB_ENGINE=sqlite
 #DB_PASSWORD=
 #DB_HOST=localhost
 #DB_PORT=5432
+
+# SQLite settings (only used when DB_ENGINE=sqlite)
+#DB_PATH=/app/data/db.sqlite3
diff --git a/.forgejo/workflows/docker.yml b/.forgejo/workflows/docker.yml
new file mode 100644
index 0000000..c78499f
--- /dev/null
+++ b/.forgejo/workflows/docker.yml
@@ -0,0 +1,44 @@
+name: Docker
+
+on:
+  push:
+    branches:
+      - master
+    tags:
+      - 'v*'
+
+jobs:
+  build:
+    runs-on: docker-cli
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Log in to Codeberg registry
+        if: startsWith(github.ref, 'refs/tags/')
+        uses: docker/login-action@v3
+        with:
+          registry: codeberg.org
+          username: ${{ secrets.REGISTRY_USER }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
+
+      - name: Extract version tag
+        if: startsWith(github.ref, 'refs/tags/')
+        id: meta
+        run: echo "tag=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
+
+      - name: Build (verify only, no push)
+        if: github.ref == 'refs/heads/master'
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: false
+
+      - name: Build and push (tagged release)
+        if: startsWith(github.ref, 'refs/tags/')
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: true
+          tags: |
+            codeberg.org/${{ github.repository }}:${{ steps.meta.outputs.tag }}
+            codeberg.org/${{ github.repository }}:latest
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..850dd33
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,22 @@
+FROM python:3.11-slim
+
+ENV PYTHONDONTWRITEBYTECODE=1
+ENV PYTHONUNBUFFERED=1
+
+WORKDIR /app
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY . .
+
+# Create volume mount points
+RUN mkdir -p /app/media /app/static /app/data
+
+# Collect static files at build time (uses a dummy key, no DB needed)
+RUN SECRET_KEY=build-time-placeholder DB_ENGINE=sqlite python manage.py collectstatic --noinput
+
+EXPOSE 8000
+
+RUN chmod +x entrypoint.sh
+ENTRYPOINT ["./entrypoint.sh"]
diff --git a/allauth_oauth/apps.py b/allauth_oauth/apps.py
new file mode 100644
index 0000000..69b727a
--- /dev/null
+++ b/allauth_oauth/apps.py
@@ -0,0 +1,12 @@
+# This file is part of photo21
+# Copyright (C) 2022  Amicale des élèves de l'ENS Paris-Saclay
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+from django.apps import AppConfig
+
+
+class AllauthOAuthConfig(AppConfig):
+    name = "allauth_oauth"
+
+    def ready(self):
+        import allauth_oauth.signals  # noqa: F401
diff --git a/allauth_oauth/signals.py b/allauth_oauth/signals.py
new file mode 100644
index 0000000..d7f1cf6
--- /dev/null
+++ b/allauth_oauth/signals.py
@@ -0,0 +1,29 @@
+# This file is part of photo21
+# Copyright (C) 2022  Amicale des élèves de l'ENS Paris-Saclay
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+from allauth.socialaccount.signals import pre_social_login
+from django.dispatch import receiver
+
+
+@receiver(pre_social_login)
+def sync_user_fields(sender, request, sociallogin, **kwargs):
+    if not sociallogin.is_existing:
+        return
+
+    user = sociallogin.user
+    data = sociallogin.account.extra_data
+    changed = False
+
+    email = data.get("email")
+    if email and user.email != email:
+        user.email = email
+        changed = True
+
+    username = data.get("username")
+    if username and user.username != username:
+        user.username = username
+        changed = True
+
+    if changed:
+        user.save()
diff --git a/entrypoint.sh b/entrypoint.sh
new file mode 100644
index 0000000..37554d0
--- /dev/null
+++ b/entrypoint.sh
@@ -0,0 +1,5 @@
+#!/bin/sh
+set -e
+
+python manage.py migrate --noinput
+exec gunicorn photo21.wsgi:application --bind 0.0.0.0:8000 --workers 3
diff --git a/photo21/settings.py b/photo21/settings.py
index a80e727..ec542ea 100644
--- a/photo21/settings.py
+++ b/photo21/settings.py
@@ -153,7 +153,7 @@ elif _db_engine == "sqlite":
     DATABASES = {
         "default": {
             "ENGINE": "django.db.backends.sqlite3",
-            "NAME": os.path.join(BASE_DIR, "db.sqlite3"),
+            "NAME": config("DB_PATH", default=os.path.join(BASE_DIR, "db.sqlite3")),
             "OPTIONS": {
                 "timeout": 10,
             },
diff --git a/requirements.txt b/requirements.txt
index 242cbf3..56bdc65 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -7,5 +7,6 @@ Pillow>=6.0.0
 django-debug-toolbar>=3.2.0
 python-decouple>=3.6
 whitenoise>=6.0
-psycopg2>=2.9
+psycopg2-binary>=2.9
 requests>=2.25
+gunicorn>=21.0