diff --git a/.github/actions/ssh/action.yml b/.github/actions/ssh/action.yml
new file mode 100644
index 00000000..5c4886ab
--- /dev/null
+++ b/.github/actions/ssh/action.yml
@@ -0,0 +1,42 @@
+name: SSH setup
+description: Set up the SSH agent
+
+inputs:
+  config:
+    description: The SSH configuration
+    required: true
+  key:
+    description: The private SSH key
+    required: true
+  known-hosts:
+    description: The list of known hosts
+    required: true
+
+runs:
+  using: composite
+
+  steps:
+    - name: Configure SSH
+      shell: sh
+      env:
+        CONFIG: ${{ inputs.config }}
+        KNOWN_HOSTS: ${{ inputs.known-hosts }}
+      run: |
+        mkdir -p ~/.ssh
+        echo "${CONFIG}" > ~/.ssh/config
+        echo "${KNOWN_HOSTS}" > ~/.ssh/known_hosts
+
+    - name: Start SSH agent
+      shell: bash
+      env:
+        SOCKET: /tmp/ssh-agent.sock
+      run: |
+        echo "SSH_AUTH_SOCK=${SOCKET}" >> $GITHUB_ENV
+        ssh-agent -a ${SOCKET} > /dev/null
+
+    - name: Add SSH key
+      shell: bash
+      env:
+        KEY: ${{ inputs.key }}
+      run: |
+        ssh-add - <<< "${KEY}"
diff --git a/.github/workflows/stage.yml b/.github/workflows/stage.yml
index af3e3b17..81d709eb 100644
--- a/.github/workflows/stage.yml
+++ b/.github/workflows/stage.yml
@@ -1,10 +1,10 @@
 name: Deploy (Staging)
 
 on:
-  workflow_dispatch
-
-env:
-  SSH_AUTH_SOCK: /tmp/ssh-agent.sock
+  workflow_dispatch: {}
+  push:
+    branches:
+      - helma-🐜
 
 jobs:
   stage:
@@ -17,6 +17,13 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Set up SSH agent
+        uses: ./.github/actions/ssh
+        with:
+          config: ${{ vars.SSH_CONFIG }}
+          key: ${{ secrets.SSH_PRIVATE_KEY }}
+          known-hosts: ${{ vars.SSH_KNOWN_HOSTS }}
+
       - name: Set up Java
         uses: actions/setup-java@v4
         with:
@@ -29,14 +36,6 @@ jobs:
       - name: Build with Gradle
         run: ./gradlew installDist
 
-      - name: Set up SSH agent
-        run: |
-          ssh-agent -a $SSH_AUTH_SOCK > /dev/null
-          ssh-add - <<< "${{ secrets.SSH_PRIVATE_KEY }}"
-          mkdir -p ~/.ssh
-          echo '${{ vars.SSH_CONFIG }}' > ~/.ssh/config
-          echo '${{ vars.KNOWN_HOSTS }}' > ~/.ssh/known_hosts
-
       - name: Publish to staging server
         run: |
           rsync build/install/helma/ antville.dev:/ \