diff --git a/.github/workflows/mainnet-deploy.yml b/.github/workflows/mainnet-deploy.yml
new file mode 100644
index 00000000..2ceb9fd7
--- /dev/null
+++ b/.github/workflows/mainnet-deploy.yml
@@ -0,0 +1,40 @@
+name: RSK Explorer mainnet build and deploy
+
+on:
+  push:
+    branches: [master]
+
+jobs:
+  mainnet_build_and_deploy:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+
+      - name: Setup Node 16
+        uses: actions/setup-node@v1
+        with:
+          node-version: "16"
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build site
+        run: npm run build-with-tracking:mainnet
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.MAINNET_ROLE_ARN }}
+          aws-region: ${{ secrets.MAINNET_AWS_REGION }}
+
+      - name: Deploy site to S3
+        run: |
+          aws s3 sync --sse aws:kms --sse-kms-key-id ${{ secrets.MAINNET_KMS_KEY_ID }} --delete --only-show-errors --exclude .gitkeep dist/ ${{ secrets.MAINNET_S3_BUCKET }}
+      - name: Invalidate CloudFront cache
+        run: |
+          aws cloudfront create-invalidation --distribution-id ${{ secrets.MAINNET_CLOUDFRONT_DISTRIBUTION }} --paths "/*"