diff --git a/_quarto.yml b/_quarto.yml
index 30af73472..8a68760fd 100644
--- a/_quarto.yml
+++ b/_quarto.yml
@@ -7,6 +7,7 @@ project:
     - "/docs/download/_download.json"
     - "/docs/download/_prerelease.json"
     - "/_redirects"
+    - "/netlify.toml"
     - "/docs/blog/posts/2024-07-02-beautiful-tables-in-typst/demo"
     - "/.well-known/atproto-did"
 
diff --git a/netlify.toml b/netlify.toml
new file mode 100644
index 000000000..5ad15495e
--- /dev/null
+++ b/netlify.toml
@@ -0,0 +1,12 @@
+# Static redirects for tool downloads
+# (Dynamic Quarto release redirects are in _redirects, auto-generated by CI)
+
+# veraPDF installer - PDF/A validation tool
+# Open wildcard redirect: any version passes through to S3
+# - No netlify.toml update needed when veraPDF version changes
+# - Invalid versions simply 404 at S3 level (S3 acts as validator)
+# - Only used by `quarto install tool verapdf`, not public-facing
+[[redirects]]
+  from = "/download/verapdf/:version/*"
+  to = "https://s3.amazonaws.com/rstudio-buildtools/quarto/verapdf/:version/:splat"
+  status = 301