diff --git a/.github/workflows/blog-framework.yml b/.github/workflows/blog-framework.yml
index 20bec15..b77a78b 100644
--- a/.github/workflows/blog-framework.yml
+++ b/.github/workflows/blog-framework.yml
@@ -12,17 +12,19 @@ on:
       - 'posts*.json'
       - '.github/workflows/blog-framework.yml'
   push:
+    # Any push to main redeploys the whole site (Astro build of dist/),
+    # so root chrome like index*.html / sitemap.xml / CNAME is picked up too.
     branches:
       - main
-    paths:
-      - 'astro.config.mjs'
-      - 'package.json'
-      - 'package-lock.json'
-      - 'scripts/**'
-      - 'src/**'
-      - 'blog/**'
-      - 'posts*.json'
-      - '.github/workflows/blog-framework.yml'
+
+# GITHUB_TOKEN defaults; the deploy job widens its own permissions below.
+permissions:
+  contents: read
+
+# Never run two Pages deployments at once; let an in-flight one finish.
+concurrency:
+  group: pages
+  cancel-in-progress: false
 
 jobs:
   build-and-check:
@@ -84,3 +86,41 @@ jobs:
           if [ -f /tmp/bytefuture-preview.pid ]; then
             kill "$(cat /tmp/bytefuture-preview.pid)" || true
           fi
+
+  # Publish the Astro build (dist/) to GitHub Pages on every push to main.
+  # Requires the repo's Pages source to be set to "GitHub Actions".
+  deploy:
+    needs: build-and-check
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build Astro static site
+        run: npm run build
+
+      - name: Upload Pages artifact
+        uses: actions/upload-pages-artifact@v3
+        with:
+          path: dist
+
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v4