diff --git a/.tangled/workflows/deploy.yml b/.tangled/workflows/deploy.yml
new file mode 100644
index 0000000..3ee13fa
--- /dev/null
+++ b/.tangled/workflows/deploy.yml
@@ -0,0 +1,27 @@
+when:
+  - event: push
+    branch: main
+
+engine: nixery
+
+dependencies:
+  nixpkgs:
+    - flyctl
+    - git
+
+steps:
+  - name: deploy to fly.io
+    command: |
+      test -n "$FLY_API_TOKEN"
+
+      # skip deploys for pushes that only touch docs or workflow files.
+      # if the diff can't be resolved, deploy — a redundant deploy beats
+      # silently skipping a needed one.
+      changed=$(git diff --name-only HEAD^ HEAD 2>/dev/null) || changed="src/"
+      if [ -n "$changed" ] && ! echo "$changed" | grep -qv -e '\.md$' -e '^\.tangled/' -e '^docs/'; then
+        echo "docs/workflow-only push — skipping deploy"
+        echo "$changed" | sed 's/^/  /'
+        exit 0
+      fi
+
+      flyctl deploy --remote-only