diff --git a/.github/workflows/site-deploy.yml b/.github/workflows/site-deploy.yml
new file mode 100644
index 0000000..4ec0063
--- /dev/null
+++ b/.github/workflows/site-deploy.yml
@@ -0,0 +1,58 @@
+name: site-deploy
+
+# getghostcrab.com marketing site (site/ Astro -> Workers Static Assets).
+# Cloudflare's Git-integrated Workers Builds never produced a green deploy
+# (every run since 2026-07 failed, including the wrangler-config fix in
+# PR #68; build logs are only visible in the CF dashboard). This workflow
+# owns the deploy instead, so a broken build/deploy is a visible red check
+# here. Requires repo secret CLOUDFLARE_API_TOKEN ("Edit Cloudflare
+# Workers" token template). The dashboard Git integration should be
+# disconnected once this is green, so the two paths don't race.
+
+on:
+  pull_request:
+    paths:
+      - "site/**"
+      - "wrangler.jsonc"
+      - ".github/workflows/site-deploy.yml"
+  push:
+    branches: [main]
+    paths:
+      - "site/**"
+      - "wrangler.jsonc"
+      - ".github/workflows/site-deploy.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: site-deploy-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  site:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: site/package-lock.json
+
+      - name: Install
+        working-directory: site
+        run: npm ci
+
+      - name: Build
+        working-directory: site
+        run: npm run build
+
+      - name: Deploy to Cloudflare Workers
+        if: github.event_name != 'pull_request'
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: "7c2523de841058b55de07942589f8bf5"
+        run: npx --yes wrangler@4 deploy
diff --git a/wrangler.jsonc b/wrangler.jsonc
index fb3e4b7..8dd10e7 100644
--- a/wrangler.jsonc
+++ b/wrangler.jsonc
@@ -9,5 +9,12 @@
   // no assets" - which is why the Workers Builds check failed on every PR.
   "assets": {
     "directory": "./site/dist"
-  }
-}
\ No newline at end of file
+  },
+  // Bind the production domain to the worker. Without this the worker only
+  // serves workers.dev and getghostcrab.com 530s: the zone's DNS record
+  // pointed at nothing that exists. custom_domain provisions the DNS
+  // record automatically on deploy.
+  "routes": [
+    { "pattern": "getghostcrab.com", "custom_domain": true }
+  ]
+}