diff --git a/.dockerignore b/.dockerignore
index 38b6026..7bd6323 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -4,7 +4,7 @@
 .env.test
 infra/dev/
 infra/prod/docker-compose.yml
-infra/prod/deploy.sh
+infra/prod/deploy.sh.example
 infra/prod/.env.example
 frontend/node_modules
 frontend/.nuxt
diff --git a/infra/prod/Dockerfile b/infra/prod/Dockerfile
index 4b0ba5d..e53a919 100644
--- a/infra/prod/Dockerfile
+++ b/infra/prod/Dockerfile
@@ -64,6 +64,7 @@ RUN rm -f /etc/nginx/sites-enabled/default
 COPY infra/prod/supervisord.conf /etc/supervisor/conf.d/app.conf
 COPY infra/prod/nginx.conf /etc/nginx/sites-enabled/inventory.conf
 COPY infra/prod/maintenance.html /var/www/html/public/maintenance.html
+COPY infra/prod/deploy.sh /var/www/html/infra/prod/deploy.sh
 
 # Backend from stage 1
 COPY --from=backend-build /app /var/www/html
diff --git a/infra/prod/deploy.sh b/infra/prod/deploy.sh
index f6139b8..20be576 100755
--- a/infra/prod/deploy.sh
+++ b/infra/prod/deploy.sh
@@ -6,6 +6,28 @@ cd "$(dirname "$0")"
 TAG="${1:-latest}"
 export INVENTORY_IMAGE_TAG="$TAG"
 
+# --- Self-update from Docker image ---
+# After pulling the new image, extracts this script from it.
+# If the version inside the image differs, replaces itself and re-executes.
+if [ "${_DEPLOY_UPDATED:-0}" != "1" ]; then
+    echo "==> Pulling image..."
+    sudo docker compose pull
+
+    SELF="$(realpath "$0")"
+    TEMP_SCRIPT="$(mktemp)"
+    sudo docker compose run --rm --no-deps -T --entrypoint cat app /var/www/html/infra/prod/deploy.sh > "$TEMP_SCRIPT" 2>/dev/null || true
+
+    if [ -s "$TEMP_SCRIPT" ] && ! diff -q "$SELF" "$TEMP_SCRIPT" > /dev/null 2>&1; then
+        echo "==> deploy.sh updated from image, re-executing..."
+        cp "$TEMP_SCRIPT" "$SELF"
+        chmod +x "$SELF"
+        rm -f "$TEMP_SCRIPT"
+        export _DEPLOY_UPDATED=1
+        exec "$SELF" "$@"
+    fi
+    rm -f "$TEMP_SCRIPT"
+fi
+
 echo "==> Deploying inventory:${TAG}..."
 
 # Fix storage directory structure (one-time migration fix)
@@ -24,8 +46,11 @@ sudo chown -R www-data:www-data storage
 echo "==> Enabling maintenance mode..."
 touch maintenance.on
 
-echo "==> Pulling image..."
-sudo docker compose pull
+# Pull image (skip if already pulled during self-update)
+if [ "${_DEPLOY_UPDATED:-0}" != "1" ]; then
+    echo "==> Pulling image..."
+    sudo docker compose pull
+fi
 
 echo "==> Starting container..."
 sudo docker compose up -d