diff --git a/.github/workflows/build-push-api.yml b/.github/workflows/build-push-api.yml
deleted file mode 100644
index 52dd85ae..00000000
--- a/.github/workflows/build-push-api.yml
+++ /dev/null
@@ -1,42 +0,0 @@
-name: Build and Push Docker Image to GHCR
-
-on:
-  push:
-    branches:
-      - master
-    paths:
-      - 'apps/api/**'
-  workflow_dispatch:
-
-permissions:
-  contents: read
-  packages: write
-
-jobs:
-  build-and-push:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Set up QEMU for cross-platform builds
-        uses: docker/setup-qemu-action@v2
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-
-      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v2
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Build and push multi-arch image
-        run: |
-          docker buildx build \
-            --platform linux/amd64,linux/arm64 \
-            --push \
-            -t ghcr.io/${{ github.repository_owner }}/core-api:latest \
-            ./apps/api
diff --git a/.github/workflows/prod-build-deploy-api.yml b/.github/workflows/prod-build-deploy-api.yml
new file mode 100644
index 00000000..90e6d5e4
--- /dev/null
+++ b/.github/workflows/prod-build-deploy-api.yml
@@ -0,0 +1,92 @@
+name: Deploy API to Production
+
+on:
+  push:
+    branches:
+      - master
+    paths:
+      - 'apps/api/**'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+concurrency:
+  group: production-deploy
+  cancel-in-progress: true
+
+jobs:
+  build-and-push:
+    name: Build and Push Docker Image to GHCR
+    runs-on: ubuntu-latest
+    outputs:
+      image_tag: ${{ steps.set-tag.outputs.image_tag }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up QEMU for cross-platform builds
+        uses: docker/setup-qemu-action@v2
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push multi-arch image
+        run: |
+          docker buildx build \
+            --platform linux/amd64,linux/arm64 \
+            --push \
+            -t ghcr.io/${{ github.repository_owner }}/core-api:latest \
+            ./apps/api
+
+  run-migrations:
+    name: Run Goose Migrations
+    runs-on: ubuntu-latest
+    needs: build-and-push
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install Goose
+        run: |
+          curl -L https://github.com/pressly/goose/releases/latest/download/goose_linux_amd64 --output goose
+          chmod +x goose
+          sudo mv goose /usr/local/bin/goose
+
+      - name: Run migrations
+        run: |
+          goose -dir ./apps/api/internal/db/migrations postgres "${{ secrets.PROD_DB_URL }}" up
+
+  deploy:
+    name: Deploy to Production Server
+    runs-on: ubuntu-latest
+    needs: [build-and-push, run-migrations]
+
+    steps:
+      - name: SSH proxy commmand
+        uses: appleboy/ssh-action@v1
+        with:
+          host: ${{ secrets.SSH_HOST_SWAMPHACKS }}
+          username: ${{ secrets.SSH_USERNAME_SWAMPHACKS }}
+          key: ${{ secrets.SSH_KEY_SWAMPHACKS }}
+          port: ${{ secrets.SSH_PORT_SWAMPHACKS }}
+          proxy_host: ${{ secrets.SSH_HOST_JUMP }}
+          proxy_username: ${{ secrets.SSH_USERNAME_JUMP }}
+          proxy_key: ${{ secrets.SSH_KEY_JUMP }}
+          proxy_port: ${{ secrets.SSH_PORT_JUMP }}
+        script: |
+          cd /home/admin/core/infra
+          git pull
+          infisical export --env=prod --format=dotenv --path="/api" --projectId=${{ secrets.INFISICAL_PROJECT_ID }} > ./secrets/.env.api
+          docker compose pull api
+          docker compose up -d --no-deps --force-recreate api
diff --git a/infra/secrets/README.md b/infra/secrets/README.md
new file mode 100644
index 00000000..92cd8248
--- /dev/null
+++ b/infra/secrets/README.md
@@ -0,0 +1,13 @@
+## Secrets for production and development builds will go in the folder
+
+The following environments will be generated using the Infiscal CLI tool. What is Infiscal? That is our secret manager!
+
+- .env.api
+- .env.web
+- .env.dev.api
+- .env.dev.web
+
+...  and more!
+
+### Add more?
+Please let the core maintainers when it comes to adding more env variables!