diff --git a/deploy.sh b/deploy.sh
new file mode 100644
index 0000000..6235021
--- /dev/null
+++ b/deploy.sh
@@ -0,0 +1,31 @@
+#!/bin/bash
+# Kehadiran Taklimat SPR — Production Deploy Script
+# Dipanggil oleh container webhook selepas git push ke GitHub (branch master).
+set -e
+
+PROJECT_DIR="/srv/spr2026_taklimat"
+LOG="$PROJECT_DIR/deploy.log"
+
+log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG"; }
+
+log "=== Deploy dimulakan ==="
+
+cd "$PROJECT_DIR"
+
+# git jalan sebagai root dlm container; repo milik user host -> elak "dubious ownership".
+git config --global --add safe.directory "$PROJECT_DIR"
+
+log "git pull..."
+git pull origin master
+
+# Kod di-bake dalam image (bukan bind-mount) -> perlu build semula.
+# Hanya service aplikasi yg di-recreate; container 'webhook' SENGAJA tidak
+# disenaraikan supaya ia tidak bunuh dirinya sendiri di tengah deploy.
+# Entrypoint app jalankan migrate + config/route/view:cache automatik masa boot.
+log "build & recreate (app, web, queue, scheduler)..."
+docker compose up -d --build --force-recreate app web queue scheduler
+
+log "buang image lama yg tidak digunakan..."
+docker image prune -f
+
+log "=== Deploy selesai ==="
diff --git a/docker-compose.yml b/docker-compose.yml
index 635a3ba..bd1053c 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -61,5 +61,25 @@ services:
     depends_on:
       - app
 
+  # Webhook deploy (GitHub push -> git pull + rebuild). Dengar 127.0.0.1:9001;
+  # host nginx reverse-proxy /hooks/ ke sini. WEBHOOK_SECRET dari .env.docker.
+  webhook:
+    build:
+      context: ./docker/webhook
+    image: taklimatspr-webhook:latest
+    restart: unless-stopped
+    env_file:
+      - .env.docker
+    ports:
+      - "127.0.0.1:9001:9000"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - ./docker/webhook/hooks.json:/etc/webhook/hooks.json:ro
+      - ./deploy.sh:/deploy.sh:ro
+      - .:/srv/spr2026_taklimat
+      # Kunci SSH host utk `git pull` repo peribadi (abaikan jika repo awam/HTTPS).
+      - /root/.ssh:/root/.ssh:ro
+    command: -hooks=/etc/webhook/hooks.json -hotreload -verbose
+
 volumes:
   app_storage:
diff --git a/docker/host-nginx/taklimatspr.apps.mbip.my.conf b/docker/host-nginx/taklimatspr.apps.mbip.my.conf
index ffb21e4..410eeca 100644
--- a/docker/host-nginx/taklimatspr.apps.mbip.my.conf
+++ b/docker/host-nginx/taklimatspr.apps.mbip.my.conf
@@ -29,4 +29,21 @@ server {
         proxy_connect_timeout 30s;
         proxy_read_timeout    60s;
     }
+
+    # GitHub webhook deploy -> container webhook (adnanh/webhook) di 127.0.0.1:9001.
+    # Endpoint GitHub: https://taklimatspr.apps.mbip.my/hooks/deploy
+    location /hooks/ {
+        proxy_pass http://127.0.0.1:9001;
+
+        proxy_set_header Host            $host;
+        proxy_set_header X-Real-IP       $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+
+        # Deploy (build) ambil masa; bagi masa yg cukup utk response.
+        proxy_read_timeout 600s;
+    }
 }
+
+# NOTA: Selepas pasang SSL (certbot), blok di atas biasanya bertukar jadi
+# `listen 443 ssl`. Pastikan KEDUA-DUA `location /` dan `location /hooks/`
+# berada dalam blok 443 itu, dan `X-Forwarded-Proto $scheme` kekal ada.
diff --git a/docker/webhook/Dockerfile b/docker/webhook/Dockerfile
new file mode 100644
index 0000000..9ec52ce
--- /dev/null
+++ b/docker/webhook/Dockerfile
@@ -0,0 +1,10 @@
+FROM golang:1.23-alpine AS builder
+RUN go install github.com/adnanh/webhook@2.8.1
+
+FROM alpine:3.21
+# docker-cli + compose plugin: deploy.sh perlu `docker compose build`
+# (kod taklimat di-bake dalam image, bukan bind-mount).
+RUN apk add --no-cache git docker-cli docker-cli-compose openssh-client
+COPY --from=builder /go/bin/webhook /usr/local/bin/webhook
+EXPOSE 9000
+ENTRYPOINT ["/usr/local/bin/webhook"]
diff --git a/docker/webhook/hooks.json b/docker/webhook/hooks.json
new file mode 100644
index 0000000..dd726d5
--- /dev/null
+++ b/docker/webhook/hooks.json
@@ -0,0 +1,32 @@
+[
+  {
+    "id": "deploy",
+    "execute-command": "/deploy.sh",
+    "command-working-directory": "/srv/spr2026_taklimat",
+    "response-message": "Deploy dimulakan.",
+    "trigger-rule": {
+      "and": [
+        {
+          "match": {
+            "type": "payload-hmac-sha256",
+            "secret": "{{ .Env.WEBHOOK_SECRET }}",
+            "parameter": {
+              "source": "header",
+              "name": "X-Hub-Signature-256"
+            }
+          }
+        },
+        {
+          "match": {
+            "type": "value",
+            "value": "refs/heads/master",
+            "parameter": {
+              "source": "payload",
+              "name": "ref"
+            }
+          }
+        }
+      ]
+    }
+  }
+]