diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
new file mode 100644
index 00000000..5db362b7
--- /dev/null
+++ b/.gitlab-ci.yml
@@ -0,0 +1,118 @@
+stages:
+  - build
+  - deploy
+
+build_sshpiper:
+  stage: build
+  tags:
+    - build
+  only:
+    - main
+  before_script:
+    # Install Go 1.23+ (required for sshpiper)
+    - |
+      GO_VERSION="1.23.4"
+      GO_INSTALL_DIR="$HOME/go-${GO_VERSION}"
+      GO_TARBALL="$HOME/go${GO_VERSION}.linux-amd64.tar.gz"
+      if [ ! -d "$GO_INSTALL_DIR" ]; then
+        echo "Installing Go ${GO_VERSION} to $GO_INSTALL_DIR..."
+        if [ ! -f "$GO_TARBALL" ]; then
+          echo "Downloading Go ${GO_VERSION}..."
+          wget -q https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz -O "$GO_TARBALL"
+        else
+          echo "Using cached Go tarball"
+        fi
+        cd $HOME
+        tar -xzf "$GO_TARBALL"
+        mv go go-${GO_VERSION}
+        echo "Go ${GO_VERSION} installed successfully"
+      else
+        echo "Go ${GO_VERSION} already installed at $GO_INSTALL_DIR"
+      fi
+    - export GOROOT=$HOME/go-${GO_VERSION}
+    - export GOPATH=$HOME/go
+    - export PATH=$GOROOT/bin:$GOPATH/bin:$PATH
+    - $GOROOT/bin/go version
+  script:
+    - echo "Building sshpiper with fingerprint passthrough..."
+    - export GO_VERSION="1.23.4"
+    - export GOROOT=$HOME/go-${GO_VERSION}
+    - export GOPATH=$HOME/go
+    - export PATH=$GOROOT/bin:$GOPATH/bin:$PATH
+    - cd $CI_PROJECT_DIR
+    # Initialize submodules (crypto fork)
+    - git submodule update --init --recursive
+    # Build sshpiperd with yaml plugin
+    - $GOROOT/bin/go build -tags full -o sshpiperd ./cmd/sshpiperd
+    - |
+      if [ $? -ne 0 ]; then
+        echo "Failed to build sshpiper. Aborting."
+        exit 1
+      fi
+    - echo "sshpiper built successfully."
+    - ./sshpiperd --help | head -20
+  artifacts:
+    paths:
+      - sshpiperd
+    expire_in: 1 week
+
+deploy_sshpiper:
+  stage: deploy
+  tags:
+    - cammy.foxhop.net
+  only:
+    - main
+  dependencies:
+    - build_sshpiper
+  before_script:
+    - which systemctl || (echo "systemctl not found!" && exit 1)
+  script:
+    - echo "Deploying sshpiper to cammy..."
+
+    # Stop existing service
+    - sudo /bin/systemctl stop sshpiper.service || echo "Service was not running"
+
+    # Deploy binary
+    - sudo /bin/cp $CI_PROJECT_DIR/sshpiperd /opt/unsandbox/sshpiper/sshpiperd
+    - sudo /bin/chmod +x /opt/unsandbox/sshpiper/sshpiperd
+
+    # Create systemd service if it doesn't exist
+    - |
+      if [ ! -f /etc/systemd/system/sshpiper.service ]; then
+        echo "Creating systemd service for sshpiper..."
+        sudo tee /etc/systemd/system/sshpiper.service > /dev/null <<EOF
+      [Unit]
+      Description=SSH Piper - SSH routing proxy
+      After=network.target
+
+      [Service]
+      Type=simple
+      ExecStart=/opt/unsandbox/sshpiper/sshpiperd yaml --config /opt/unsandbox/sshpiper/sshpiper.yaml
+      Restart=on-failure
+      RestartSec=5
+      StandardOutput=journal
+      StandardError=journal
+
+      [Install]
+      WantedBy=multi-user.target
+      EOF
+        sudo /bin/systemctl daemon-reload
+      fi
+
+    # Start service
+    - sudo /bin/systemctl restart sshpiper.service
+    - |
+      if [ $? -eq 0 ]; then
+        echo "sshpiper service restarted successfully."
+      else
+        echo "Failed to restart sshpiper service."
+        exit 1
+      fi
+
+    - sudo /bin/systemctl enable sshpiper.service
+    - sudo /bin/systemctl status sshpiper.service --no-pager
+
+    - echo "Deployment completed successfully."
+
+  after_script:
+    - echo "Deployment process completed."