diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 8e91f3d8d84f8efe831773d6fe5c490d2356aa45..d2d4bff3b07599687382022a04a2d239db70f2df 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,5 +1,6 @@
 stages:
   - build
+  - deploy
 
 variables:
   GIT_DEPTH: 1
@@ -16,3 +17,24 @@ build:
     expire_in: 1w
     paths:
       - site/
+
+deploy:
+  variables:
+    HOME: /root
+  stage: deploy
+  when: manual
+  only:
+    - /^master$/
+  needs:
+    - build
+  before_script:
+    - source .gitlab-ci/utils.sh
+    - authenticate_krb
+  script:
+    - >
+      rsync -av --delete
+      site/
+      ${SERVICE_ACCOUNT_USERNAME}@lxplus.cern.ch:${EOS_SITE_PATH}/
+  after_script:
+    - source .gitlab-ci/utils.sh
+    - unauthenticate_krb
diff --git a/.gitlab-ci/utils.sh b/.gitlab-ci/utils.sh
new file mode 100644
index 0000000000000000000000000000000000000000..3980027ceacf735704c4eeb7064e94b85dc5dd66
--- /dev/null
+++ b/.gitlab-ci/utils.sh
@@ -0,0 +1,20 @@
+authenticate_krb () {
+    local SERVICE_ACCOUNT_PASSWORD=$(echo ${SERVICE_ACCOUNT_PASSWORD} | base64 -d)
+    echo ${SERVICE_ACCOUNT_PASSWORD} | kinit -A -f ${SERVICE_ACCOUNT_USERNAME}@CERN.CH
+
+    mkdir -p ${HOME}/.ssh
+    chmod go-rwx -R ${HOME}/.ssh
+    touch ${HOME}/.ssh/config
+    chmod go-rw ${HOME}/.ssh/config
+    cat<<EOF>${HOME}/.ssh/config
+HashKnownHosts            yes
+StrictHostKeyChecking     no
+GSSAPIAuthentication      yes
+GSSAPITrustDNS            yes
+GSSAPIDelegateCredentials yes
+EOF
+}
+
+unauthenticate_krb () {
+    kdestroy
+}