diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 800a719..b1c5a61 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -9,31 +9,35 @@ jobs:
   build-and-push:
     name: Build and Push Docker Image
     runs-on: ubuntu-latest
+    outputs:
+      tag: ${{ steps.vars.outputs.tag }}
 
     steps:
       - name: Checkout code
         uses: actions/checkout@v3
 
+      - name: Set image tag (short SHA)
+        id: vars
+        run: echo "tag=${GITHUB_SHA::7}" >> $GITHUB_OUTPUT
+
       - name: Login to Docker Hub
         run: echo "${{ secrets.DOCKERHUB_TOKEN }}" | docker login -u "${{ secrets.DOCKERHUB_USERNAME }}" --password-stdin
 
-      - name: Build Docker image
+      - name: Build Docker image (tagged)
         run: |
-          docker build -t ${{ secrets.DOCKERHUB_USERNAME }}/portfolio:latest .
+          docker build -t ${{ secrets.DOCKERHUB_USERNAME }}/portfolio:${{ steps.vars.outputs.tag }} .
 
-      - name: Push image to Docker Hub
+      - name: Push Docker image (tagged)
         run: |
-          docker push ${{ secrets.DOCKERHUB_USERNAME }}/portfolio:latest
+          docker push ${{ secrets.DOCKERHUB_USERNAME }}/portfolio:${{ steps.vars.outputs.tag }}
 
   deploy:
     name: Deploy to VPS
     needs: build-and-push
     runs-on: ubuntu-latest
+    environment: production
 
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v3
-
       - name: Setup SSH key
         run: |
           mkdir -p ~/.ssh
@@ -41,6 +45,25 @@ jobs:
           chmod 600 ~/.ssh/id_rsa
           ssh-keyscan -p ${{ secrets.VPS_PORT }} -H ${{ secrets.VPS_HOST }} >> ~/.ssh/known_hosts
 
+      - name: Ensure portfolio directory exists on VPS
+        run: |
+          ssh -i ~/.ssh/id_rsa -p ${{ secrets.VPS_PORT }} -o StrictHostKeyChecking=no ${{ secrets.VPS_USER }}@${{ secrets.VPS_HOST }} "mkdir -p /home/${{ secrets.VPS_USER }}/portfolio"
+
+      - name: Create .env for deploy
+        run: |
+          echo "DOCKERHUB_USERNAME=${{ secrets.DOCKERHUB_USERNAME }}" > .env
+          echo "PORTFOLIO_IMAGE_TAG=${{ needs.build-and-push.outputs.tag }}" >> .env
+
+      - name: Copy .env to VPS
+        uses: appleboy/scp-action@master
+        with:
+          host: ${{ secrets.VPS_HOST }}
+          username: ${{ secrets.VPS_USER }}
+          key: ${{ secrets.VPS_SSH_KEY }}
+          port: ${{ secrets.VPS_PORT }}
+          source: '.env'
+          target: '/home/${{ secrets.VPS_USER }}/portfolio/'
+
       - name: Copy docker-compose.yml to VPS
         uses: appleboy/scp-action@master
         with:
diff --git a/docker-compose.yml b/docker-compose.yml
index e77f3b8..d0fdcc6 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
   portfolio:
-    image: vchikalkin/portfolio:latest
+    image: ${DOCKERHUB_USERNAME}/portfolio:${PORTFOLIO_IMAGE_TAG}
     networks:
       - web