diff --git a/.tangled/workflows/deploy-tap.yml b/.tangled/workflows/deploy-tap.yml
index 3104f2b..8e8258b 100644
--- a/.tangled/workflows/deploy-tap.yml
+++ b/.tangled/workflows/deploy-tap.yml
@@ -1,75 +1,23 @@
-# Set up AND deploy the self-hosted Tap service (atmoquest-tap) to Fly.io.
+# Deploy the self-hosted Tap service (atmoquest-tap) to Fly.io.
 #
-# Manual trigger only — run it yourself from the repo's Pipelines page on any
-# branch (the `branch` filter has no effect for manual events). It is fully
-# idempotent: safe to re-run. It creates the Fly app + volume if missing,
-# deploys Tap, and points the main `atmoquest` app at it.
+# Runs on merge/push to main, alongside the main atmoquest deploy. The
+# Dockerfile go-installs cmd/tap at the pinned indigo version, so a deploy
+# picks up any version bump committed to deploy/tap/Dockerfile.
 #
-# REQUIREMENTS (one-time, in this repo's Tangled settings → secrets):
-#   FLY_API_TOKEN  — an ORG-scoped Fly token (so it can create the app/volume).
-#                    Create with: flyctl tokens create org <org-slug>
-#                    flyctl reads this automatically; do not echo it.
-# Optional pipeline environment override (Settings → not secret):
-#   FLY_ORG        — Fly org slug. Auto-detected from the `atmoquest` app if unset.
+# The Fly app, volume, and atmoquest's TAP_WS_ENDPOINT secret are created once
+# out-of-band (see deploy/tap/README.md). This pipeline only redeploys.
+#
+# Requires FLY_API_TOKEN in this repo's Tangled settings → secrets.
 when:
-  - event: ["manual"]
+  - event: ["push"]
+    branch: ["main"]
 
 engine: "nixery"
 
 dependencies:
   nixpkgs:
     - flyctl
-    - jq
 
 steps:
-  - name: "Set up and deploy Tap"
-    command: |
-      set -euo pipefail
-
-      APP=atmoquest-tap
-      MAIN_APP=atmoquest
-      REGION=lax
-      VOLUME=atmoquest_tap_data
-
-      # Resolve the Fly org from the existing main app (override via FLY_ORG).
-      ORG="${FLY_ORG:-$(flyctl apps list --json \
-        | jq -r --arg a "$MAIN_APP" '.[] | select((.Name // .name)==$a) | (.Organization.Slug // .organization.slug)' \
-        | head -n1)}"
-      if [ -z "$ORG" ]; then
-        echo "ERROR: could not resolve Fly org. Set FLY_ORG in the pipeline environment." >&2
-        exit 1
-      fi
-      echo "Using Fly org: $ORG"
-
-      # 1. Create the Tap app if it doesn't already exist.
-      if flyctl apps list --json | jq -e --arg a "$APP" '.[] | select((.Name // .name)==$a)' >/dev/null; then
-        echo "App $APP already exists; skipping create."
-      else
-        echo "Creating app $APP..."
-        flyctl apps create "$APP" --org "$ORG"
-      fi
-
-      # 2. Create the data volume if it doesn't already exist.
-      if flyctl volumes list -a "$APP" --json | jq -e --arg v "$VOLUME" '.[] | select((.name // .Name)==$v)' >/dev/null 2>&1; then
-        echo "Volume $VOLUME already exists; skipping create."
-      else
-        echo "Creating volume $VOLUME..."
-        flyctl volumes create "$VOLUME" -a "$APP" --region "$REGION" --size 1 --yes
-      fi
-
-      # 3. Build + deploy Tap. The Dockerfile go-installs cmd/tap from the
-      #    network and COPYs nothing from the build context, so context dir is
-      #    irrelevant; we run from deploy/tap so fly.toml is picked up.
-      echo "Deploying Tap..."
-      ( cd deploy/tap && flyctl deploy --remote-only )
-
-      # 4. Wire the main app to Tap over the private network — only if not
-      #    already set, since setting a secret restarts atmoquest.
-      if flyctl secrets list -a "$MAIN_APP" --json | jq -e '.[] | select((.Name // .name)=="TAP_WS_ENDPOINT")' >/dev/null 2>&1; then
-        echo "TAP_WS_ENDPOINT already set on $MAIN_APP; leaving it."
-      else
-        echo "Setting TAP_WS_ENDPOINT on $MAIN_APP..."
-        flyctl secrets set TAP_WS_ENDPOINT="ws://atmoquest-tap.internal:2480/channel" -a "$MAIN_APP"
-      fi
-
-      echo "✓ Tap setup complete."
+  - name: "Deploy Tap to Fly.io"
+    command: "cd deploy/tap && flyctl deploy --remote-only"
diff --git a/deploy/tap/README.md b/deploy/tap/README.md
index dd44ccd..cc6122b 100644
--- a/deploy/tap/README.md
+++ b/deploy/tap/README.md
@@ -11,45 +11,32 @@ It runs as its **own Fly app** (`atmoquest-tap`), not part of the main
 unless `TAP_WS_ENDPOINT` is set, and reciprocity falls back to the login-drain
 queue.
 
-## Setup & deploy (Tangled pipeline)
+## One-time setup (done out-of-band)
 
-Everything is done by one **manual** Tangled pipeline:
-[deploy-tap.yml](../../.tangled/workflows/deploy-tap.yml). Trigger it from the
-repo's Pipelines page (any branch — `manual` ignores the branch filter). It is
-idempotent and safe to re-run; it:
-
-1. creates the `atmoquest-tap` Fly app (if missing),
-2. creates the `atmoquest_tap_data` volume (if missing),
-3. builds + deploys Tap,
-4. sets `TAP_WS_ENDPOINT` on the `atmoquest` app (if not already set).
-
-**Before the first run**, add one secret in this repo's Tangled settings:
-
-- `FLY_API_TOKEN` — an **org-scoped** Fly token so the pipeline can create the
-  app/volume. Create it locally with `flyctl tokens create org <org-slug>` and
-  paste the value into Tangled → repo settings → secrets. (An app-scoped deploy
-  token can deploy but cannot create apps/volumes.)
+Run these once, locally, with your Fly org slug:
 
-Optional: set `FLY_ORG` as a pipeline environment variable if auto-detection
-from the `atmoquest` app doesn't find your org.
+```bash
+flyctl apps create atmoquest-tap --org <org-slug>
+flyctl volumes create atmoquest_tap_data --app atmoquest-tap --region lax --size 1 --yes
+flyctl secrets set TAP_WS_ENDPOINT="ws://atmoquest-tap.internal:2480/channel" --app atmoquest
+```
 
 Tap runs in collection-signal mode, so it auto-discovers every repo that writes
 a `quest.atmo.connection` record — no `/repos/add` calls needed.
 
-### Doing it by hand instead
+## Deploying
 
-If you'd rather not use the pipeline, the equivalent local commands are:
+Redeploys go through one **manual** Tangled pipeline:
+[deploy-tap.yml](../../.tangled/workflows/deploy-tap.yml). Trigger it from the
+repo's Pipelines page (any branch — `manual` ignores the branch filter). It
+just runs `flyctl deploy` from this directory, so it needs `FLY_API_TOKEN` in
+the repo's Tangled settings → secrets.
 
-```bash
-flyctl apps create atmoquest-tap --org <org-slug>
-flyctl volumes create atmoquest_tap_data --app atmoquest-tap --region lax --size 1
-( cd deploy/tap && flyctl deploy --remote-only )
-flyctl secrets set TAP_WS_ENDPOINT="ws://atmoquest-tap.internal:2480/channel" --app atmoquest
-```
+Equivalently, by hand: `( cd deploy/tap && flyctl deploy --remote-only )`.
 
 Tap rarely changes, so it is intentionally **not** part of the per-push
-`atmoquest` deploy — redeploy it via the manual pipeline when you bump the
-indigo/Tap version.
+`atmoquest` deploy — redeploy via the pipeline when you bump the indigo/Tap
+version in the Dockerfile.
 
 ## Keeping versions in sync