diff --git a/README.md b/README.md
index c5dc70a..05bcdf1 100644
--- a/README.md
+++ b/README.md
@@ -1,3 +1,11 @@
 # nix configuration
 
 Use at your own risk.
+
+## Deploying
+
+The `./deploy` script generates a NixOS configuration that pins the current git `HEAD` of this project and copies the resulting `configuration.nix` to the destionation host. Then it tests the new confiurations and rolls back if it fails.
+
+## TODO
+
+- Use `nix-copy-closure`?
diff --git a/deploy b/deploy
index 0a76c9f..10dc47e 100755
--- a/deploy
+++ b/deploy
@@ -22,7 +22,7 @@ host="${1}"
 rev="$(git rev-parse HEAD)"
 sha256=$(hash "$rev")
 
-cat <<EOF | ssh "${host}".dadada.li 'sudo nix-shell -p tmux --run "cat - > /etc/nixos/configuration.nix && tmux new -d \"nixos-rebuild switch |& tee /var/log/dadada-deploy.log\""'
+cat <<EOF | ssh "${host}".dadada.li 'sudo cat - > /etc/nixos/configuration.nix && (nixos-rebuild test && nixos-rebuild switch) || (nixos-rebuild switch --rollback && exit 1)'
 { config, pkgs, ... }:
 let
   host = "$host";