diff --git a/.tangled/workflows/deploy.yml b/.tangled/workflows/deploy.yml
new file mode 100644
index 0000000..6ea00d7
--- /dev/null
+++ b/.tangled/workflows/deploy.yml
@@ -0,0 +1,25 @@
+# Test and deploy the site image to Fly on every push to main.
+# FLY_API_TOKEN is a repository secret (a deploy token scoped to the
+# cameron-stream app). ATProto About/Knowledge reconciliation is not done here;
+# it stays on the credential-provisioned local worker.
+when:
+  - event: ["push"]
+    branch: ["main"]
+  - event: ["manual"]
+
+engine: "nixery"
+
+dependencies:
+  nixpkgs:
+    - nodejs_22
+    - flyctl
+
+steps:
+  - name: "Install"
+    command: "npm ci --no-audit --no-fund"
+  - name: "Typecheck"
+    command: "npm run typecheck"
+  - name: "Test"
+    command: "npm run test:markdown && npm run test:content && npm run test:charts"
+  - name: "Deploy"
+    command: "flyctl deploy --remote-only --depot=false"