diff --git a/deploy/deploy-test.sh b/deploy/deploy-test.sh
new file mode 100755
index 0000000..6cdae25
--- /dev/null
+++ b/deploy/deploy-test.sh
@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# Deploy a test instance to the Debian server (ssh alias "softvisor") on port 3333.
+# Builds a static x86_64 binary in Docker, ships it with the frontend, installs a
+# systemd unit. Safe to re-run: keeps the existing .env (and therefore the DB/admin).
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+HOST=${HOST:-softvisor}
+PORT=${PORT:-3333}
+DIR=/opt/monitoring
+
+echo "== build frontend"
+(cd frontend && npm run build >/dev/null)
+echo "== build static linux binary (docker)"
+docker run --rm -v "$PWD/backend":/home/rust/src -v cargo-registry-musl:/root/.cargo/registry \
+  messense/rust-musl-cross:x86_64-musl cargo build --release -p api -q
+
+echo "== upload"
+ssh "$HOST" "mkdir -p $DIR/data"
+rsync -az backend/target/x86_64-unknown-linux-musl/release/monitoring-server "$HOST:$DIR/monitoring-server"
+rsync -az --delete frontend/dist/ "$HOST:$DIR/dist/"
+
+echo "== configure (first run only)"
+if ! ssh "$HOST" "test -f $DIR/.env"; then
+  ADMIN_PW=$(openssl rand -base64 18 | tr -d '/+=' | head -c 20)
+  ssh "$HOST" "umask 077; cat > $DIR/.env" <<ENV
+DATABASE_URL=sqlite://$DIR/data/monitoring.db?mode=rwc
+JWT_SECRET=$(openssl rand -hex 32)
+BIND=0.0.0.0:$PORT
+BOOTSTRAP_ADMIN_EMAIL=admin@softvisor.de
+BOOTSTRAP_ADMIN_PASSWORD=$ADMIN_PW
+COOKIE_SECURE=false
+FRONTEND_DIR=$DIR/dist
+RUST_LOG=info,sqlx=warn
+ENV
+  echo "Bootstrap admin: admin@softvisor.de / $ADMIN_PW  (change it after first login)"
+fi
+
+echo "== systemd"
+ssh "$HOST" "cat > /etc/systemd/system/monitoring.service" <<UNIT
+[Unit]
+Description=SoftVisor Infrastructure Monitoring (test deployment)
+After=network.target
+
+[Service]
+WorkingDirectory=$DIR
+EnvironmentFile=$DIR/.env
+ExecStart=$DIR/monitoring-server
+Restart=on-failure
+
+[Install]
+WantedBy=multi-user.target
+UNIT
+ssh "$HOST" "systemctl daemon-reload && systemctl enable -q monitoring.service && systemctl restart monitoring.service && sleep 2 && systemctl is-active monitoring.service && curl -s http://127.0.0.1:$PORT/healthz && echo"
+echo "== done: http://$(ssh "$HOST" hostname -I | awk '{print $1}'):$PORT/"