diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index b723f2369..e70ff287c 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -26,6 +26,7 @@ stages:
   - prebuild
   - build
   - test
+  - deploy
 
 before_script:
   - pipenv sync
@@ -35,3 +36,4 @@ include:
   - ci/prebuild.yml
   - ci/build.yml
   - ci/test.yml
+  - ci/deploy.yml
diff --git a/ci/deploy.yml b/ci/deploy.yml
new file mode 100644
index 000000000..c8d9b8e5e
--- /dev/null
+++ b/ci/deploy.yml
@@ -0,0 +1,40 @@
+image: registry.gitlab.com/satoshilabs/trezor/trezor-firmware/environment
+
+# Core
+
+core to upgrade tests deploy:
+  stage: deploy
+  variables:
+    DEPLOY_DIRECTORY: "${DEPLOY_BASE_DIR}upgrade_tests/"
+  before_script: []  # no pipenv
+  when: manual
+  dependencies:
+    - core unix frozen debug build
+  script:
+    - TAG=`git tag --points-at HEAD | sed "s/\//-/"`
+    - "[[ ! $TAG =~ 'core' ]] && echo 'Tag is not core/*: exiting.' && exit 1"
+    - DEST=${DEPLOY_DIRECTORY}/trezor-emu-`git tag --points-at HEAD | sed "s/\//-/"`
+    - echo "Deploying to $DEST"
+    - rsync --delete -va core/build/unix/micropython "$DEST"
+  tags:
+    - deploy
+
+
+# Legacy
+
+legacy to upgrade tests deploy:
+  stage: deploy
+  variables:
+    DEPLOY_DIRECTORY: "${DEPLOY_BASE_DIR}upgrade_tests/"
+  before_script: []  # no pipenv
+  when: manual
+  dependencies:
+    - legacy emu regular build
+  script:
+    - TAG=`git tag --points-at HEAD | sed "s/\//-/"`
+    - "[[ ! $TAG =~ 'legacy' ]] && echo 'Tag is not legacy/*: exiting.' && exit 1"
+    - DEST=${DEPLOY_DIRECTORY}/trezor-emu-`git tag --points-at HEAD | sed "s/\//-/"`
+    - echo "Deploying to $DEST"
+    - rsync --delete -va legacy/firmware/trezor.elf "$DEST"
+  tags:
+    - deploy