diff --git a/config/deploy/production.hcl b/config/deploy/production.hcl
new file mode 100644
index 0000000..4a8b30d
--- /dev/null
+++ b/config/deploy/production.hcl
@@ -0,0 +1,55 @@
+variable "branch_or_sha" {
+  type = string
+  default = "main"
+}
+job "imagecat-production" {
+  region = "global"
+  datacenters = ["dc1"]
+  node_pool = "production"
+  type = "service"
+  group "web" {
+    count = 2
+    network {
+      port "http" { to = 3000 }
+    }
+    service {
+      port = "http"
+      check {
+        type = "http"
+        port = "http"
+        path = "/"
+        interval = "10s"
+        timeout = "1s"
+      }
+    }
+    task "webserver" {
+      driver = "podman"
+      config {
+        image = "ghcr.io/pulibrary/imagecat-rails:${ var.branch_or_sha }"
+        ports = ["http"]
+        force_pull = true
+      }
+      template {
+        destination = "${NOMAD_SECRETS_DIR}/env.vars"
+        env = true
+        change_mode = "restart"
+        data = <<EOF
+        {{- with nomadVar "nomad/jobs/imagecat-production" -}}
+        SECRET_KEY_BASE = '{{ .SECRET_KEY_BASE }}'
+        APP_DB = {{ .DB_NAME }}
+        APP_DB_USERNAME = {{ .DB_USER }}
+        APP_DB_PASSWORD = {{ .DB_PASSWORD }}
+        APP_DB_HOST = {{ .POSTGRES_HOST }}
+        APPLICATION_HOST = 'imagecat.princeton.edu'
+        APPLICATION_HOST_PROTOCOL = 'https'
+        APPLICATION_PORT = '443'
+        AWS_ACCESS_KEY_ID = {{ .AWS_ACCESS_KEY_ID }}
+        AWS_SECRET_ACCESS_KEY = {{ .AWS_SECRET_ACCESS_KEY }}
+        AWS_DEFAULT_REGION = 'us-east-1'
+        RAILS_ENV = 'production'
+        {{- end -}}
+        EOF
+      }
+    }
+  }
+}
diff --git a/config/deploy/staging.hcl b/config/deploy/staging.hcl
index 609ce75..6fcd9ad 100644
--- a/config/deploy/staging.hcl
+++ b/config/deploy/staging.hcl
@@ -46,6 +46,7 @@ job "imagecat-staging" {
         AWS_ACCESS_KEY_ID = {{ .AWS_ACCESS_KEY_ID }}
         AWS_SECRET_ACCESS_KEY = {{ .AWS_SECRET_ACCESS_KEY }}
         AWS_DEFAULT_REGION = 'us-east-1'
+        RAILS_ENV = 'staging'
         {{- end -}}
         EOF
       }