diff --git a/.github/workflows/site.yml b/.github/workflows/site.yml
new file mode 100644
index 0000000..14720b4
--- /dev/null
+++ b/.github/workflows/site.yml
@@ -0,0 +1,62 @@
+name: Site
+
+# durable.wavezync.com (site/). Builds on PRs; deploys to Cloudflare Workers on
+# main. The site reads the packages' docs, mix.exs and lib/, so changes there
+# rebuild it too. Needs the CLOUDFLARE_API_TOKEN secret ("Edit Cloudflare
+# Workers" token for the WaveZync account).
+
+on:
+  push:
+    branches: [main]
+    paths: &paths
+      - "site/**"
+      - "shared.exs"
+      - "durable/*.md"
+      - "durable/guides/**"
+      - "durable/lib/**"
+      - "durable/mix.exs"
+      - "durable_dashboard/*.md"
+      - "durable_dashboard/mix.exs"
+      - ".github/workflows/site.yml"
+  pull_request:
+    branches: [main]
+    paths: *paths
+  workflow_dispatch:
+
+concurrency:
+  group: site-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  site:
+    name: Build and deploy
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: site
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v6
+        with:
+          version: 10
+
+      - name: Set up Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: "24"
+          cache: pnpm
+          cache-dependency-path: site/pnpm-lock.yaml
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build
+        run: pnpm run build
+
+      - name: Deploy to Cloudflare
+        if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+        run: pnpm exec wrangler deploy
diff --git a/site/wrangler.jsonc b/site/wrangler.jsonc
index d6048ae..d646576 100644
--- a/site/wrangler.jsonc
+++ b/site/wrangler.jsonc
@@ -1,9 +1,10 @@
 // durable.wavezync.com: the built Astro site (dist/), served as Workers static assets.
 // The site is fully static, so there is no Worker script (`main`) and no ASSETS binding.
-// `pnpm run deploy` builds the site and deploys it.
+// `pnpm run deploy` builds the site and deploys it; CI deploys main (.github/workflows/site.yml).
 {
   "$schema": "node_modules/wrangler/config-schema.json",
   "name": "durable",
+  "account_id": "f69696ea6aec9975d75a770144674386",
   "compatibility_date": "2026-10-01",
   "assets": {
     "directory": "./dist",