diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index cf65c59..d9f4814 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -1,8 +1,8 @@
 name: Build and validate
 
+# PR-only: push to main is covered by deploy.yml, which validates and then
+# deploys in one job — running both here too would just duplicate the check.
 on:
-  push:
-    branches: [main]
   pull_request:
 
 jobs:
diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
new file mode 100644
index 0000000..d8f6081
--- /dev/null
+++ b/.gitea/workflows/deploy.yml
@@ -0,0 +1,23 @@
+name: Deploy
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  deploy:
+    # Runs on a repo-scoped self-hosted runner living on the same box that
+    # serves hcl.archipelago-foundation.org, specifically so deploy is a
+    # plain local file copy — no SSH keys or remote credentials to manage.
+    runs-on: hcl-deploy
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Build and validate every report
+        run: python3 scripts/build.py
+
+      - name: Deploy to the live docroot
+        run: rsync -a --delete site/ /var/www/hcl.archipelago-foundation.org/
diff --git a/README.md b/README.md
index ead0b5b..43835c7 100644
--- a/README.md
+++ b/README.md
@@ -6,8 +6,7 @@ what didn't, and why. Model, CPU, RAM, storage, and WiFi chip for every
 report, since WiFi chipsets are consistently the thing most likely to bite
 someone doing an install on repurposed hardware.
 
-**[Browse the list →](https://hcl.archipelago-foundation.org)** (once deployed —
-see [Deployment](#deployment) below)
+**[Browse the list →](https://hcl.archipelago-foundation.org)**
 
 ## Why this exists
 
@@ -73,11 +72,33 @@ python3 -m http.server 8000 --directory site
 
 ## Deployment
 
-Not yet deployed. This is a static site (`site/`) with no backend — any
-static host works (the same nginx-in-front-of-a-container pattern archy's
-other apps already use, GitHub/Gitea Pages, or a plain S3-style bucket).
-`scripts/build.py` should run in CI on every push to `main` so `data.json`
-never drifts from the source reports; wiring that up is the next step.
+Live at **https://hcl.archipelago-foundation.org** — a static site (`site/`)
+served by nginx, cert via `certbot certonly --webroot` (same pattern as
+`regress.atobitcoin.io` and this project's other nginx-fronted sites).
+
+Deployment is fully automatic: `.gitea/workflows/deploy.yml` runs on every
+push to `main` on a repo-scoped self-hosted runner (`hcl-local-deploy`,
+label `hcl-deploy`) living on the same box that serves the site — it runs
+`scripts/build.py` and `rsync`s `site/` straight into the docroot, so
+`data.json` can never drift from the source reports. No SSH keys or remote
+credentials involved; the runner has local filesystem access since it's on
+the same machine. `.gitea/workflows/ci.yml` runs the same build/validate
+step on pull requests, on the (separate, shared) `vps2-runner`, so bad data
+gets caught before merge rather than at deploy time.
+
+Runner setup, for reference (repo-scoped registration token from
+Settings → Actions → Runners → Create new Runner):
+
+```bash
+gitea-runner register --no-interactive \
+  --instance <gitea-url> --token <token> \
+  --name hcl-local-deploy --labels "hcl-deploy:host" \
+  --config /etc/gitea-runner-hcl/config.yaml
+```
+
+running as a systemd service (`gitea-runner-hcl.service`) under a user that
+owns the docroot directly — deliberately not root, and no sudo needed for
+the deploy step itself.
 
 ## License