diff --git a/.github/workflows/cf.yaml b/.github/workflows/cf.yaml
new file mode 100644
index 0000000..bf1dcf8
--- /dev/null
+++ b/.github/workflows/cf.yaml
@@ -0,0 +1,69 @@
+name: Cloud Foundry
+
+on:
+  workflow_call:
+    inputs:
+      environment:
+        default: Staging
+        type: string
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+  deployments: write
+  packages: read
+
+concurrency:
+  group: cf-${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+env:
+  APP_NAME: xtravels
+  NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  FORCE_COLOR: true
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          registry-url: https://npm.pkg.github.com/
+      - uses: actions/setup-java@v5
+        with:
+          distribution: sapmachine
+          java-version: 21
+          cache: maven
+      - uses: cap-js/cf-setup@v2
+        with:
+          api: ${{ vars.CF_API }}
+          org: ${{ vars.CF_ORG }}
+          space: ${{ vars.CF_SPACE }}
+          username: ${{ vars.CF_USERNAME }}
+          password: ${{ secrets.CF_PASSWORD }}
+      - run: npm install
+        env:
+          NODE_AUTH_TOKEN: ${{secrets.GITHUB_TOKEN}}
+
+      - run: npx cds up
+
+      - run: cf logs "${{ env.APP_NAME }}" --recent
+        if: always()
+      - run: cf logs "${{ env.APP_NAME }}-srv" --recent
+        if: always()
+      - run: cf logs "${{ env.APP_NAME }}-db-deployer" --recent
+        if: always()
+
+      - name: Get application URL
+        id: route
+        shell: bash
+        run: |
+          host=$(cf app "${APP_NAME}" | awk '/routes:/ {print $2}' | sed -E 's#^https?://##; s/,.*$//')
+          echo "url=https://$host" >> "$GITHUB_OUTPUT"
+    environment:
+      name: ${{ inputs.environment || 'Staging' }}
+      url:  ${{ steps.route.outputs.url }}
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
new file mode 100644
index 0000000..76c1143
--- /dev/null
+++ b/.github/workflows/release.yaml
@@ -0,0 +1,22 @@
+name: Release
+
+on:
+  workflow_dispatch:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+  deployments: write
+  packages: read
+
+jobs:
+  tests:
+     uses: capire/xtravels-java/.github/workflows/maven.yaml@main
+     secrets: inherit
+  deploy-cf:
+    needs: [tests]
+    uses: capire/xtravels-java/.github/workflows/cf.yaml@main
+    secrets: inherit
+    with:
+      environment: Production
diff --git a/srv/src/main/resources/application.yaml b/srv/src/main/resources/application.yaml
index 3b12bba..135dd3f 100644
--- a/srv/src/main/resources/application.yaml
+++ b/srv/src/main/resources/application.yaml
@@ -14,10 +14,6 @@ management:
     db.enabled: true
 cds:
   drafts.enforce-readonly: true
-  security.mock.users:
-    admin:
-      roles:
-      - admin
   data-source.csv.paths:
   - "db/data/**"
   - "../db/data/**"
@@ -27,6 +23,15 @@ cds:
   - "../node_modules/@capire/**"
   - "../../node_modules/@capire/**"
 ---
+spring:
+  config.activate.on-profile: "!cloud"
+
+cds:
+  security.mock.users:
+    admin:
+      roles:
+        - admin
+---
 spring:
   config.activate.on-profile: hybrid
 cds: