diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index f350b13..11f3ef5 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -64,6 +64,6 @@ jobs:
           echo "::error::homelab not reachable over Tailscale"; exit 1
 
       - name: Deploy blog to homelab
-        # Use the deploy-rs pinned in flake.lock (via the devShell) so the
+        # Use the deploy-rs pinned in flake.lock (via the deploy app) so the
         # CLI matches the lib that built the activation profile.
-        run: nix develop --command deploy .#homelab.blog
+        run: nix run .#deploy -- .#homelab.blog
diff --git a/flake.nix b/flake.nix
index 98a543c..85ade0c 100644
--- a/flake.nix
+++ b/flake.nix
@@ -43,6 +43,11 @@
             treefmt.enable = true;
           };
 
+          apps.deploy = {
+            type = "app";
+            program = "${inputs.deploy-rs.packages.${system}.default}/bin/deploy";
+          };
+
           packages.blog = pkgs.stdenvNoCC.mkDerivation {
             pname = "ankarhem-blog-site";
             version = "0";