diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 5f11610..b4fa3a3 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -70,7 +70,7 @@ jobs:
           $SUDO ln -sfn "$DATA_ROOT/projects" "$RELEASE_DIR/data/projects"
           $SUDO ln -sfn "$DATA_ROOT/image-projects" "$RELEASE_DIR/data/image-projects"
           $SUDO chown -R root:root "$APP_ROOT"
-          $SUDO chown -R "$SERVICE_USER:$SERVICE_USER" "$DATA_ROOT"
+          $SUDO chown -R "$SERVICE_USER:$SERVICE_USER" "$DATA_ROOT/projects" "$DATA_ROOT/image-projects"
           $SUDO ln -sfn "$RELEASE_DIR" "$APP_ROOT/current"
           $SUDO rm -f /etc/rednote-tool-studio.password
 
diff --git a/deploy/postgres/README.md b/deploy/postgres/README.md
new file mode 100644
index 0000000..fb552c8
--- /dev/null
+++ b/deploy/postgres/README.md
@@ -0,0 +1,20 @@
+# PostgreSQL deployment
+
+The production database runs through Docker Compose and is only exposed on the server loopback interface.
+It is managed independently from the application CI deployment.
+
+- Database: `rednote_studio`
+- User: `rednote_studio`
+- Address from the host: `127.0.0.1:5432`
+- Persistent data: `/var/lib/rednote-tool-studio/postgres`
+- Password secret: `/etc/rednote-tool-studio/postgres-password`
+
+Start or update it on the production host:
+
+```bash
+docker compose -f /opt/rednote-tool-studio/postgres/compose.yml pull
+docker compose -f /opt/rednote-tool-studio/postgres/compose.yml up -d
+docker compose -f /opt/rednote-tool-studio/postgres/compose.yml ps
+```
+
+The password file must already exist, be owned by root, and use mode `0600`. Never commit it to the repository.
diff --git a/deploy/postgres/compose.yml b/deploy/postgres/compose.yml
new file mode 100644
index 0000000..d4d32c6
--- /dev/null
+++ b/deploy/postgres/compose.yml
@@ -0,0 +1,33 @@
+name: rednote-tool-studio
+
+services:
+  postgres:
+    image: postgres:17-bookworm
+    restart: unless-stopped
+    shm_size: 256mb
+    environment:
+      POSTGRES_DB: rednote_studio
+      POSTGRES_USER: rednote_studio
+      POSTGRES_PASSWORD_FILE: /run/secrets/postgres_password
+    secrets:
+      - postgres_password
+    ports:
+      - "127.0.0.1:5432:5432"
+    volumes:
+      - /var/lib/rednote-tool-studio/postgres:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U rednote_studio -d rednote_studio"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+      start_period: 20s
+    stop_grace_period: 60s
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
+
+secrets:
+  postgres_password:
+    file: /etc/rednote-tool-studio/postgres-password