diff --git a/.gitea/workflows/deploy-transport-canary.yml b/.gitea/workflows/deploy-transport-canary.yml
new file mode 100644
index 0000000..dd0527a
--- /dev/null
+++ b/.gitea/workflows/deploy-transport-canary.yml
@@ -0,0 +1,25 @@
+name: Dev deployment transport canary
+
+on:
+  workflow_dispatch:
+
+jobs:
+  verify-runner-to-dev:
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Configure restricted deployment key
+        env:
+          DEV_DEPLOY_SSH_KEY: ${{ secrets.DEV_DEPLOY_SSH_KEY }}
+        run: |
+          set -eu
+          test -n "$DEV_DEPLOY_SSH_KEY"
+          install -d -m 700 ~/.ssh
+          printf '%s\n' "$DEV_DEPLOY_SSH_KEY" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          ssh-keyscan -H 192.168.1.114 >> ~/.ssh/known_hosts
+      - name: Verify deployment endpoint and candidate registry pull
+        run: |
+          set -eu
+          ssh -i ~/.ssh/id_ed25519 cicd-deploy@192.168.1.114 verify
+          ssh -i ~/.ssh/id_ed25519 cicd-deploy@192.168.1.114 \
+            'candidate agent gitea.waternetwork.cn/orgtjwater/tjwateragent:latest'