diff --git a/web/src/lib/api/sites.test.ts b/web/src/lib/api/sites.test.ts
new file mode 100644
index 000000000..cebd22405
--- /dev/null
+++ b/web/src/lib/api/sites.test.ts
@@ -0,0 +1,28 @@
+import { describe, expect, it, vi } from "vitest";
+import oauthMetadata from "$lib/oauth-client-metadata";
+import { missingPermissions } from "$lib/auth/scopes";
+
+vi.mock("$lib/auth/agent", () => ({
+	createClient: () => ({}),
+	mintServiceAuth: async () => "token",
+	serviceDidForHost: (host: string) => `did:web:${host}`,
+	hostForServiceDid: () => null
+}));
+
+const { sitesPermissions } = await import("$lib/api/sites");
+
+const sites = new URL("https://sites.test");
+
+describe("sites permissions", () => {
+	it("covers every method the repo sites panel calls, deploySite included", () => {
+		const permissions = sitesPermissions(sites);
+		expect(permissions).toHaveLength(4);
+		expect(missingPermissions("atproto", permissions)).toEqual(permissions);
+		expect(missingPermissions(oauthMetadata.scope, permissions)).toEqual([]);
+		expect(permissions).toContainEqual({
+			resource: "rpc",
+			lxm: "org.tangled.temp.repo.deploySite",
+			aud: "did:web:sites.test"
+		});
+	});
+});
diff --git a/web/src/lib/api/sites.ts b/web/src/lib/api/sites.ts
index bb9f8bf18..cbd15f712 100644
--- a/web/src/lib/api/sites.ts
+++ b/web/src/lib/api/sites.ts
@@ -1,5 +1,9 @@
 import { authedGet, authedPost, type AppviewContext } from "$lib/api/appview";
+import { serviceDidForHost } from "$lib/auth/agent";
+import type { Permission } from "$lib/auth/scopes";
+import { didOf } from "$lib/api/syntax";
 import type { XrpcRequestInit } from "$lib/api/client";
+import type { Nsid } from "@atcute/lexicons/syntax";
 
 interface DomainClaimResponse {
 	domain?: string;
@@ -11,27 +15,18 @@ const RELEASE_DOMAIN = "org.tangled.temp.site.releaseDomain";
 const GET_SITE_CONFIG = "org.tangled.temp.repo.getSiteConfig";
 const UPDATE_SITE_CONFIG = "org.tangled.temp.repo.updateSiteConfig";
 const DISABLE_SITE = "org.tangled.temp.repo.disableSite";
+const DEPLOY_SITE = "org.tangled.temp.repo.deploySite";
 
+// these procedures differ only by nsid and input shape
+const posting =
+	<Arg>(nsid: string, body: (arg: Arg) => object) =>
+	(ctx: AppviewContext, arg: Arg, init?: XrpcRequestInit): Promise<void> =>
+		authedPost(ctx, nsid, body(arg), init).then(() => undefined);
 
-export const getDomainClaim = async (
-	ctx: AppviewContext,
-	init?: XrpcRequestInit
-): Promise<string | null> => {
-	const res = await authedGet<DomainClaimResponse>(ctx, GET_DOMAIN_CLAIM, undefined, init);
-	return res.domain ?? null;
-};
-
-export const claimDomain = (
-	ctx: AppviewContext,
-	domain: string,
-	init?: XrpcRequestInit
-): Promise<void> => authedPost(ctx, CLAIM_DOMAIN, { domain }, init).then(() => undefined);
+const byRepoDid = (repoDid: string) => ({ repoDid });
 
-export const releaseDomain = (
-	ctx: AppviewContext,
-	domain: string,
-	init?: XrpcRequestInit
-): Promise<void> => authedPost(ctx, RELEASE_DOMAIN, { domain }, init).then(() => undefined);
+export const claimDomain = posting(CLAIM_DOMAIN, (domain: string) => ({ domain }));
+export const releaseDomain = posting(RELEASE_DOMAIN, (domain: string) => ({ domain }));
 
 export interface SiteConfig {
 	branch: string;
@@ -43,15 +38,6 @@ interface SiteConfigResponse {
 	config?: SiteConfig;
 }
 
-export const getSiteConfig = async (
-	ctx: AppviewContext,
-	repoDid: string,
-	init?: XrpcRequestInit
-): Promise<SiteConfig | null> => {
-	const res = await authedGet<SiteConfigResponse>(ctx, GET_SITE_CONFIG, { repoDid }, init);
-	return res.config ?? null;
-};
-
 export interface SiteConfigParams {
 	repoDid: string;
 	name: string;
@@ -62,14 +48,31 @@ export interface SiteConfigParams {
 	isIndex: boolean;
 }
 
-export const updateSiteConfig = (
+export const updateSiteConfig = posting(UPDATE_SITE_CONFIG, (params: SiteConfigParams) => params);
+export const deploySite = posting(DEPLOY_SITE, byRepoDid);
+export const disableSite = posting(DISABLE_SITE, byRepoDid);
+
+const SITE_METHODS = [GET_SITE_CONFIG, UPDATE_SITE_CONFIG, DISABLE_SITE, DEPLOY_SITE] as const;
+
+// repo-panel methods; the account-level claim tab (/settings/sites) needs no grant
+export const sitesPermissions = (service: URL): readonly Permission[] => {
+	const aud = didOf(serviceDidForHost(service.host));
+	return SITE_METHODS.map((lxm) => ({ resource: "rpc", lxm: lxm as Nsid, aud }));
+};
+
+export const getDomainClaim = async (
 	ctx: AppviewContext,
-	params: SiteConfigParams,
 	init?: XrpcRequestInit
-): Promise<void> => authedPost(ctx, UPDATE_SITE_CONFIG, params, init).then(() => undefined);
+): Promise<string | null> => {
+	const res = await authedGet<DomainClaimResponse>(ctx, GET_DOMAIN_CLAIM, undefined, init);
+	return res.domain ?? null;
+};
 
-export const disableSite = (
+export const getSiteConfig = async (
 	ctx: AppviewContext,
 	repoDid: string,
 	init?: XrpcRequestInit
-): Promise<void> => authedPost(ctx, DISABLE_SITE, { repoDid }, init).then(() => undefined);
\ No newline at end of file
+): Promise<SiteConfig | null> => {
+	const res = await authedGet<SiteConfigResponse>(ctx, GET_SITE_CONFIG, { repoDid }, init);
+	return res.config ?? null;
+};
diff --git a/web/src/lib/oauth-client-metadata.ts b/web/src/lib/oauth-client-metadata.ts
index 055d2ae84..888b0eb91 100644
--- a/web/src/lib/oauth-client-metadata.ts
+++ b/web/src/lib/oauth-client-metadata.ts
@@ -59,9 +59,10 @@ const scopes = [
 	"rpc:org.tangled.temp.site.claimDomain?aud=*",
 	"rpc:org.tangled.temp.site.getDomainClaim?aud=*",
 	"rpc:org.tangled.temp.site.releaseDomain?aud=*",
+	"rpc:org.tangled.temp.repo.disableSite?aud=*",
+	"rpc:org.tangled.temp.repo.deploySite?aud=*",
 	"rpc:org.tangled.temp.repo.getSiteConfig?aud=*",
 	"rpc:org.tangled.temp.repo.updateSiteConfig?aud=*",
-	"rpc:org.tangled.temp.repo.disableSite?aud=*",
 	"rpc:sh.tangled.actor.getTrending?aud=*",
 	"rpc:sh.tangled.ci.cancelPipeline?aud=*",
 	"rpc:sh.tangled.ci.triggerPipeline?aud=*",
diff --git a/web/src/routes/[handle]/[repo]/settings/sites/+page.svelte b/web/src/routes/[handle]/[repo]/settings/sites/+page.svelte
index 42c64b82e..95e395c45 100644
--- a/web/src/routes/[handle]/[repo]/settings/sites/+page.svelte
+++ b/web/src/routes/[handle]/[repo]/settings/sites/+page.svelte
@@ -1,6 +1,7 @@
 <script lang="ts">
 	import { page } from "$app/state";
 	import { getAuth } from "$lib/auth.svelte";
+	import { missingPermissions } from "$lib/auth/scopes";
 	import { createAppviewClient } from "$lib/api/appview";
 	import { ClientResponseError } from "$lib/api/client";
 	import {
@@ -8,6 +9,8 @@
 		getSiteConfig,
 		updateSiteConfig,
 		disableSite,
+		deploySite,
+		sitesPermissions,
 		type SiteConfig
 	} from "$lib/api/sites";
 	import Button, { button } from "$lib/components/ui/Button.svelte";
@@ -19,6 +22,7 @@
 	import settingsSettingspanelContentSkeletonFixture from "$lib/bones/settings-settingspanel--content-skeleton-fixture.bones.json";
 	import Tag from "$lib/components/ui/Tag.svelte";
 	import ErrorAlert from "$lib/components/ui/Error.svelte";
+	import SettingsBlock from "$lib/components/settings/SettingsBlock.svelte";
 	import SettingsEmpty from "$lib/components/settings/SettingsEmpty.svelte";
 	import SettingsHeader from "$lib/components/settings/SettingsHeader.svelte";
 	import SettingsList from "$lib/components/settings/SettingsList.svelte";
@@ -35,6 +39,20 @@
 	const auth = getAuth();
 	const sitesUrl = $derived(page.data.publicConfig?.sitesUrl as string | undefined);
 	const owner = $derived(data.access.canAdminister);
+	// sessions signed in before these methods shipped hold no rpc grant and would 403
+	const ungranted = $derived(
+		auth.agent && sitesUrl
+			? missingPermissions(
+					auth.agent.session.token.scope,
+					sitesPermissions(new URL(sitesUrl))
+				)
+			: []
+	);
+	const reauthorize = createAction(async () => {
+		const did = auth.currentDid;
+		if (!did) return;
+		await auth.signIn(did, location.pathname + location.search + location.hash);
+	});
 
 	const errMessage = (err: unknown, fallback: string): string => {
 		if (err instanceof ClientResponseError) return err.description || err.error || fallback;
@@ -68,10 +86,9 @@
 		(cause) => errMessage(cause, "Failed to load site configuration.")
 	);
 
-	// createLoad reruns on auth.agent, sitesUrl and data.repo, so the panel needs no
-	// retry of its own: while the agent is null the load returns null and the skeleton holds
+	// createLoad reruns on auth.agent/sitesUrl/data.repo; repo-switch reset lives in the layout {#key}
 	type SiteForm = { branch: string; directory: string; type: "index" | "subpath" };
-	// the settled config is the one seed; an unconfigured repo prefills the knot default
+	// config wins; an unconfigured repo seeds the knot's default branch
 	const current = $derived.by((): SiteForm => {
 		const config = loaded.data?.config;
 		return {
@@ -84,10 +101,9 @@
 	const form = $derived(picked ?? current);
 	const sameForm = (a: SiteForm, b: SiteForm) =>
 		a.branch === b.branch && a.directory === b.directory && a.type === b.type;
-	// an unconfigured repo has a pending change: saving the prefilled branch is what
-	// creates the site, so the save bar is live before the first edit
+	// saving the seeded branch creates the site, so the save bar starts live
 	const unconfigured = $derived(loaded.data?.config === null);
-	const dirty = $derived(picked !== undefined ? !sameForm(picked, current) : unconfigured);
+	const dirty = $derived(!sameForm(form, current) || unconfigured);
 	const pick = (patch: Partial<SiteForm>) => (picked = { ...form, ...patch });
 	const reset = () => (picked = undefined);
 
@@ -139,12 +155,38 @@
 
 	let disableConfirmOpen = $state(false);
 
+	// the deploy only queues; outcomes land in the deploy history
+	const redeploy = createAction(
+		async (): Promise<boolean> => {
+			const agent = auth.agent;
+			const url = sitesUrl;
+			const repo = await data.repo;
+			if (!agent || !url || !repo.repoDid) return false;
+			const ctx = createAppviewClient({ apiUrl: url, agent });
+			await deploySite(ctx, repo.repoDid);
+			return true;
+		},
+		(cause) => errMessage(cause, "Failed to queue redeploy.")
+	);
+
+	// one in-flight flag locks the write controls; radios land on save
+	const busy = $derived(save.loading || disable.loading || redeploy.loading);
+
 	const confirmDisable = () => {
-		if (!loaded.data?.domain || disable.loading) return;
+		if (!loaded.data?.domain || busy) return;
 		disableConfirmOpen = true;
 	};
 </script>
 
+{#snippet siteType(value: "index" | "subpath", label: string, served: string)}
+	<div class="flex flex-col gap-1">
+		<Radio {value} group={form.type} onchange={() => pick({ type: value })} name="site-type"
+			>{label}</Radio
+		>
+		<CodeChip class="w-fit">{served}</CodeChip>
+	</div>
+{/snippet}
+
 <Pending>
 	{#snippet skeleton()}
 		<Bones capture={settingsSettingspanelContentSkeletonFixture} />
@@ -165,18 +207,28 @@
 		<p class="typography-paragraph-regular text-foreground-muted">
 			Serve a static site directly from this repository. Choose a branch and the directory
 			containing your <code class="typography-monospace-regular">index.html</code>.<br />
-			This settings panel is limited to the repository owner (the service itself does not
-			re-verify repository ownership).
+			This settings panel is limited to the repository owner (the service itself does not re-verify
+			repository ownership).
 		</p>
 	</div>
 
-	{@const actionError = save.error ?? disable.error}
+	{@const actionError = save.error ?? disable.error ?? redeploy.error}
 
-		{#if loaded.loading || loaded.data === null}
+	{#if ungranted.length > 0}
+		<ErrorAlert label={reauthorize.error} />
+		<SettingsBlock
+			title="Authorize sites"
+			description="Sites access changed after you signed in. Sign in again to grant this session the sites methods, redeploys included."
+		>
+			<Button variant="primary" loading={reauthorize.loading} onclick={reauthorize.run}>
+				Sign in again
+			</Button>
+		</SettingsBlock>
+	{:else if loaded.loading || loaded.data === null}
 		<SettingsList>
 			<Bones capture={settingsSettingspanelContentSkeletonFixture} />
 		</SettingsList>
-{:else if !owner}
+	{:else if !owner}
 		<SettingsEmpty message="The sites settings panel is limited to the repository owner." />
 	{:else if loaded.error}
 		<ErrorAlert label={loaded.error} />
@@ -205,15 +257,21 @@
 					>
 						Open
 					</a>
+					<Button
+						loading={redeploy.loading}
+						disabled={dirty || busy}
+						onclick={() => redeploy.run()}
+					>
+						Redeploy
+					</Button>
+					{#if redeploy.data}
+						<Tag color="info">Redeploy queued</Tag>
+					{/if}
 				</div>
 			{/if}
 
 			<SettingsList>
-				<SettingsRow
-					title="Branch"
-					description="The branch to deploy the site from."
-					stack
-				>
+				<SettingsRow title="Branch" description="The branch to deploy the site from." stack>
 					<Select
 						rich
 						bind:value={() => form.branch, (value) => pick({ branch: value })}
@@ -221,7 +279,7 @@
 						label="Branch"
 						searchPlaceholder="Find a branch…"
 						emptyLabel="No branch matches"
-						disabled={save.loading}
+						disabled={busy}
 						class="w-full sm:w-80"
 					/>
 				</SettingsRow>
@@ -237,7 +295,7 @@
 					<Input
 						bind:value={() => form.directory, (value) => pick({ directory: value })}
 						placeholder="/"
-						disabled={save.loading}
+						disabled={busy}
 						class="w-full sm:w-80"
 					/>
 				</SettingsRow>
@@ -252,24 +310,8 @@
 					stack
 				>
 					<div class="flex w-full flex-col gap-2 sm:w-80">
-						<div class="flex flex-col gap-1">
-							<Radio
-								value="index"
-								group={form.type}
-								onchange={() => pick({ type: "index" })}
-								name="site-type">Index site</Radio
-							>
-							<CodeChip class="w-fit">{domain}</CodeChip>
-						</div>
-						<div class="flex flex-col gap-1">
-							<Radio
-								value="subpath"
-								group={form.type}
-								onchange={() => pick({ type: "subpath" })}
-								name="site-type">Sub-path site</Radio
-							>
-							<CodeChip class="w-fit">{domain}/{repo.name}</CodeChip>
-						</div>
+						{@render siteType("index", "Index site", domain)}
+						{@render siteType("subpath", "Sub-path site", `${domain}/${repo.name}`)}
 					</div>
 				</SettingsRow>
 
@@ -283,7 +325,7 @@
 							variant="danger"
 							icon={Unlink}
 							loading={disable.loading}
-							disabled={save.loading}
+							disabled={busy}
 							onclick={confirmDisable}
 						>
 							Disable