diff --git a/.gitea/workflows/deploy-transport-canary.yml b/.gitea/workflows/deploy-transport-canary.yml
new file mode 100644
index 0000000..dd0527a
--- /dev/null
+++ b/.gitea/workflows/deploy-transport-canary.yml
@@ -0,0 +1,25 @@
+name: Dev deployment transport canary
+
+on:
+  workflow_dispatch:
+
+jobs:
+  verify-runner-to-dev:
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Configure restricted deployment key
+        env:
+          DEV_DEPLOY_SSH_KEY: ${{ secrets.DEV_DEPLOY_SSH_KEY }}
+        run: |
+          set -eu
+          test -n "$DEV_DEPLOY_SSH_KEY"
+          install -d -m 700 ~/.ssh
+          printf '%s\n' "$DEV_DEPLOY_SSH_KEY" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          ssh-keyscan -H 192.168.1.114 >> ~/.ssh/known_hosts
+      - name: Verify deployment endpoint and candidate registry pull
+        run: |
+          set -eu
+          ssh -i ~/.ssh/id_ed25519 cicd-deploy@192.168.1.114 verify
+          ssh -i ~/.ssh/id_ed25519 cicd-deploy@192.168.1.114 \
+            'candidate agent gitea.waternetwork.cn/orgtjwater/tjwateragent:latest'
diff --git a/.gitea/workflows/package-v2.yml b/.gitea/workflows/package-v2.yml
new file mode 100644
index 0000000..a15666b
--- /dev/null
+++ b/.gitea/workflows/package-v2.yml
@@ -0,0 +1,23 @@
+name: Agent CI/CD v2
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch: {}
+
+jobs:
+  build-test-publish-and-deploy:
+    uses: OrgTJWater/ci-templates/.gitea/workflows/container-cd.yml@main
+    with:
+      image_name: gitea.waternetwork.cn/orgtjwater/tjwateragent
+      dockerfile: Dockerfile
+      build_context: .
+      cache_image: gitea.waternetwork.cn/orgtjwater/tjwateragent:ci-cache
+      test_target: build
+      deploy_service: agent
+      deploy_host: 192.168.1.114
+    secrets:
+      REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+      REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+      DEV_DEPLOY_SSH_KEY: ${{ secrets.DEV_DEPLOY_SSH_KEY }}