diff --git a/web/src/pages/404.astro b/web/src/pages/404.astro
new file mode 100644
index 0000000..3a19db7
--- /dev/null
+++ b/web/src/pages/404.astro
@@ -0,0 +1,38 @@
+---
+import Layout from "../layouts/Layout.astro";
+
+// Astro special-cases src/pages/404.astro and emits it as the top-level
+// 404.html object even though every other page builds as a directory (see
+// astro.config.mjs). infra/main.tf serves that object as the
+// custom_error_response body for both 403 and 404 — the bucket is private
+// behind an origin access control, so S3 answers a missing key with 403 —
+// and web/scripts/verify-dist.mjs refuses to ship a build without it.
+//
+// Copy is PLACEHOLDER-* per CLAUDE.md: the structure is here so a human only
+// has to swap the tokens.
+---
+
+<Layout
+  title="PLACEHOLDER-QUOCKERWODGER: page not found"
+  description="PLACEHOLDER-NUDIUSTERTIAN: one line for unfurlers about a page that is not here."
+>
+  <header class="hero">
+    <h1>PLACEHOLDER-GONGOOZLER</h1>
+    <p class="hero-sub">
+      <a href="/">substandard</a>
+    </p>
+  </header>
+
+  <main>
+    <section>
+      <h2>PLACEHOLDER-TERGIVERSATE</h2>
+      <p>
+        PLACEHOLDER-VELLEITY: there is no page at this address. It may have
+        moved, or the link that sent you here may be out of date.
+      </p>
+      <p>
+        <a href="/">PLACEHOLDER-HAPAX: back to the frontpage</a>
+      </p>
+    </section>
+  </main>
+</Layout>