diff --git a/.github/workflows/deploy-mainnet.yml b/.github/workflows/deploy-mainnet.yml
new file mode 100644
index 0000000..a86bad2
--- /dev/null
+++ b/.github/workflows/deploy-mainnet.yml
@@ -0,0 +1,50 @@
+name: Deploy to Mainnet
+
+on:
+  workflow_dispatch:
+    inputs:
+      image_tag:
+        description: 'Docker image tag to deploy (commit SHA or "latest")'
+        required: true
+        default: 'latest'
+        type: string
+
+jobs:
+  deploy-mainnet:
+    runs-on: arc-runner-set
+    environment: mainnet
+    permissions:
+      contents: read
+      packages: read
+
+    env:
+      IMAGE: ghcr.io/apex-fusion/web3-mcp
+
+    steps:
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Validate image exists
+        run: docker pull ${{ env.IMAGE }}:${{ inputs.image_tag }}
+
+      - name: Deploy to Mainnet Hetzner VM
+        run: |
+          echo "${{ secrets.HETZNER_MAINNET_SSH_KEY }}" > /tmp/deploy_key
+          chmod 600 /tmp/deploy_key
+          ssh -i /tmp/deploy_key -o StrictHostKeyChecking=no \
+            ${{ secrets.HETZNER_MAINNET_USER }}@${{ secrets.HETZNER_MAINNET_HOST }} \
+            "echo ${{ secrets.GITHUB_TOKEN }} | docker login ghcr.io -u ${{ github.actor }} --password-stdin && \
+             docker pull ${{ env.IMAGE }}:${{ inputs.image_tag }} && \
+             docker stop vector-mcp || true && \
+             docker rm vector-mcp || true && \
+             docker run -d \
+               --name vector-mcp \
+               --restart unless-stopped \
+               -p 127.0.0.1:3000:3000 \
+               --env-file /etc/vector-mcp/env \
+               ${{ env.IMAGE }}:${{ inputs.image_tag }}"
+          rm /tmp/deploy_key
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index c4a5a9b..8ed9bc9 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -1,4 +1,4 @@
-name: Build and Deploy
+name: Build and Deploy (Testnet)
 
 on:
   push: