diff --git a/cloudbuild.yaml b/cloudbuild.yaml
new file mode 100644
index 0000000..eef029b
--- /dev/null
+++ b/cloudbuild.yaml
@@ -0,0 +1,79 @@
+steps:
+  - id: Build
+    name: gcr.io/cloud-builders/docker
+    args:
+      - build
+      - --no-cache
+      - -t
+      - $_GCR_HOSTNAME/$PROJECT_ID/$REPO_NAME/$_SERVICE_NAME:$COMMIT_SHA
+      - .
+      - -f
+      - Dockerfile
+  - id: Push
+    name: gcr.io/cloud-builders/docker
+    args:
+      - push
+      - $_GCR_HOSTNAME/$PROJECT_ID/$REPO_NAME/$_SERVICE_NAME:$COMMIT_SHA
+  - id: Deploy
+    name: gcr.io/google.com/cloudsdktool/cloud-sdk:slim
+    entrypoint: gcloud
+    args:
+      - run
+      - services
+      - update
+      - $_SERVICE_NAME
+      - --platform=managed
+      - --image=$_GCR_HOSTNAME/$PROJECT_ID/$REPO_NAME/$_SERVICE_NAME:$COMMIT_SHA
+      - --labels=managed-by=gcp-cloud-build-deploy-cloud-run,commit-sha=$COMMIT_SHA,gcb-build-id=$BUILD_ID,gcb-trigger-id=$_TRIGGER_ID,$_LABELS
+      - --region=$_DEPLOY_REGION
+      - --quiet
+  - id: UpdateJob
+    name: gcr.io/google.com/cloudsdktool/cloud-sdk:slim
+    entrypoint: gcloud
+    args:
+      - run
+      - jobs
+      - update
+      - $_JOB_NAME
+      - --image=$_GCR_HOSTNAME/$PROJECT_ID/$REPO_NAME/$_SERVICE_NAME:$COMMIT_SHA
+      - --region=$_DEPLOY_REGION
+      - --quiet
+  # Extracts the collectstatic output that the Dockerfile already baked into
+  # the just-built image, so Firebase Hosting can serve it directly from its
+  # own CDN (see firebase.json's rewrite, which only falls back to Cloud Run
+  # for paths that don't match a real file under public/) instead of every
+  # static-asset request proxying through Cloud Run.
+  - id: ExtractStatic
+    name: gcr.io/cloud-builders/docker
+    entrypoint: bash
+    args:
+      - -c
+      - |
+        set -e
+        docker create --name static-extract $_GCR_HOSTNAME/$PROJECT_ID/$REPO_NAME/$_SERVICE_NAME:$COMMIT_SHA
+        rm -rf public/media
+        mkdir -p public/media
+        docker cp static-extract:/orthocal/static/. public/media/
+        docker rm static-extract
+        # servestatic pre-compresses sidecar files (.br/.gz/.zstd) for its own
+        # on-disk serving scheme; Firebase Hosting compresses on the fly at
+        # its own CDN edge and never looks for these, so they'd just be dead
+        # weight in the deploy.
+        find public/media \( -name '*.br' -o -name '*.gz' -o -name '*.zstd' \) -delete
+  # Auth is implicit via the Cloud Build service account's
+  # roles/firebasehosting.admin IAM binding (Application Default
+  # Credentials, auto-detected from Cloud Build's metadata server) -- no
+  # token or key needed here.
+  - id: FirebaseDeploy
+    name: node:20
+    entrypoint: bash
+    args:
+      - -c
+      - |
+        set -e
+        npm install -g firebase-tools@15
+        firebase deploy --only hosting --project $PROJECT_ID --non-interactive
+images:
+  - $_GCR_HOSTNAME/$PROJECT_ID/$REPO_NAME/$_SERVICE_NAME:$COMMIT_SHA
+options:
+  substitutionOption: ALLOW_LOOSE