diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
new file mode 100644
index 0000000..7150a57
--- /dev/null
+++ b/.gitea/workflows/build.yml
@@ -0,0 +1,68 @@
+name: build
+
+on:
+  push:
+    branches: ["**"]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    env:
+      VROBBLER_DATABASE_URL: sqlite:///test.db
+      VROBBLER_USDA_API_KEY: ${{ vars.VROBBLER_USDA_API_KEY }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Cache pip/poetry
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cache/pip
+            ~/.cache/pypoetry
+          key: ${{ runner.os }}-py311-${{ hashFiles('**/poetry.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-py311-
+
+      - name: Install Poetry
+        run: |
+          python -m pip install --upgrade pip
+          pip install poetry
+
+      - name: Install deps
+        run: |
+          cp vrobbler.conf.test vrobbler.conf
+          poetry install --with test
+
+      - name: Pytest with coverage
+        run: |
+          poetry run pytest -n 5 --cov-report term:skip-covered --cov=vrobbler tests
+
+      - name: Notify success (ntfy)
+        if: success()
+        run: |
+          curl -fsS \
+            -H "Title: vrobbler CI success" \
+            -H "Priority: low" \
+            -H "Tags: success,vrobbler" \
+            -H "Actions: view, Changes, ${{ gitea.server_url }}/${{ gitea.repository }}/commit/${{ gitea.sha }}; view, Build, ${{ gitea.server_url }}/${{ gitea.repository }}/actions/runs/${{ gitea.run_id }}" \
+            -d "✅ Build succeeded: ${{ gitea.repository }} @ ${{ gitea.sha }}" \
+            https://ntfy.unbl.ink/drone
+
+      - name: Notify failure (ntfy)
+        if: failure()
+        run: |
+          curl -fsS \
+            -H "Title: vrobbler CI failure" \
+            -H "Priority: high" \
+            -H "Tags: failure,vrobbler" \
+            -H "Actions: view, Changes, ${{ gitea.server_url }}/${{ gitea.repository }}/commit/${{ gitea.sha }}; view, Build, ${{ gitea.server_url }}/${{ gitea.repository }}/actions/runs/${{ gitea.run_id }}" \
+            -d "❌ Build failed: ${{ gitea.repository }} @ ${{ gitea.sha }}" \
+            https://ntfy.unbl.ink/drone
diff --git a/.gitea/workflows/build-deploy.yml b/.gitea/workflows/deploy.yml
similarity index 93%
rename from .gitea/workflows/build-deploy.yml
rename to .gitea/workflows/deploy.yml
index 9d78273..ffbe7c0 100644
--- a/.gitea/workflows/build-deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -1,9 +1,8 @@
-name: build & deploy
+name: deploy
 
 on:
   push:
     tags: ["*"]
-  pull_request:
 
 jobs:
   test:
@@ -21,7 +20,6 @@ jobs:
         with:
           python-version: "3.11"
 
-      # Cache pip + Poetry caches (rough equivalent to your mounted pip_cache)
       - name: Cache pip/poetry
         uses: actions/cache@v4
         with:
@@ -46,7 +44,6 @@ jobs:
         run: |
           poetry run pytest -n 5 --cov-report term:skip-covered --cov=vrobbler tests
 
-      # Notifications (success/failure) for the test job
       - name: Notify success (ntfy)
         if: success()
         run: |
@@ -70,8 +67,6 @@ jobs:
             https://ntfy.unbl.ink/drone
 
   build-and-deploy:
-    # Only deploy on tags (equivalent to Drone when: ref: refs/tags/*)
-    if: startsWith(gitea.ref, 'refs/tags/')
     needs: [test]
     runs-on: ubuntu-latest
 
@@ -96,10 +91,8 @@ jobs:
 
       - name: Build package with commit info
         run: |
-          # Write commit to _commit.py before build
           echo "commit = '$(echo ${{ gitea.sha }} | cut -c1-8)'" > vrobbler/_commit.py
           poetry build
-          # Restore original _commit.py
           git checkout vrobbler/_commit.py
 
       - name: Copy wheel to server and deploy
diff --git a/PROJECT.org b/PROJECT.org
index be4f545..836dada 100644
--- a/PROJECT.org
+++ b/PROJECT.org
@@ -489,6 +489,19 @@ whatever time KoReader reports, we need to know, given the date and the user
 profile's historic timezone, how many hours to adjust the KoReader time to get
 to GMT to save it in the database.
 
+** DONE [#A] Fix deploy actions running twice :bug:tooling:cicd:
+:PROPERTIES:
+:ID:       aa56f2a6-2b61-4ddf-9e27-9eadcddf8412
+:END:
+
+*** Description
+
+Turns out we're now running the build-deploy action twice, once on branch push
+and once on tag push.
+
+We should do builds on each push and build and deploys only when a new tag is
+detected.
+
 * Version 39.2 [2/2]
 ** DONE [#B] Releases do not pin commit to the repo for display :bug:tooling:releases:
 :PROPERTIES: