diff --git a/.ngit/act/workflows/deployment_e2e.yaml b/.ngit/act/workflows/deployment_e2e.yaml
new file mode 100644
index 0000000..7eff82d
--- /dev/null
+++ b/.ngit/act/workflows/deployment_e2e.yaml
@@ -0,0 +1,38 @@
+# ngit-ci currently evaluates push path filters but not pull-request path
+# filters, so PRs run this workflow unconditionally.
+on:
+  push:
+    paths:
+      - ".dockerignore"
+      - "Cargo.lock"
+      - "Cargo.toml"
+      - "Dockerfile"
+      - "build.rs"
+      - "compose*.yaml"
+      - "deploy/**"
+      - "scripts/test-container-deployment.sh"
+      - "src/**"
+  pull_request:
+
+name: Container deployment e2e
+
+jobs:
+  container-deployment:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v5
+      - uses: cachix/install-nix-action@v31
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+      - name: Require the disposable guest container daemon
+        run: |
+          if [[ ! -S /var/run/docker.sock ]]; then
+            echo "container daemon socket is not available" >&2
+            echo "this workflow requires an ngit-ci operator opt-in" >&2
+            exit 1
+          fi
+      - name: Build, replace, and verify the container
+        run: |
+          nix shell nixpkgs#docker-client nixpkgs#curl nixpkgs#jq \
+            --command scripts/test-container-deployment.sh