diff --git a/site/DEPLOY.md b/site/DEPLOY.md
index 1ccc06c..3ea2328 100644
--- a/site/DEPLOY.md
+++ b/site/DEPLOY.md
@@ -10,14 +10,21 @@ browser ── Cloudflare ── assange (nginx reverse proxy, TLS) ── grouc
 ```
 
 - The site source lives in this repo under `site/` (Hugo). It is **built into a
-  static nginx image on the host** by Ansible — no Hugo on the control node, no
-  registry.
+  static nginx image on the host** — no Hugo on the control node, no registry.
 - `site/` builds legal + about pages from `docs/` (single source of truth) and
   serves screenshots generated by the Flutter golden harness.
+- **Deploy is automatic**: a Forgejo Actions workflow
+  ([`.forgejo/workflows/site.yml`](../.forgejo/workflows/site.yml)) runs on every
+  push to `main` that touches `site/**` or `docs/**`. It rsyncs `site/` straight
+  to `groucho` over SSH (runner and host share the internal subnet) and rebuilds
+  the Hugo→nginx container — no Ansible run needed for routine content changes.
+  The Ansible playbook below is now only for the one-time proxy/vhost setup and
+  as a manual fallback (e.g. deploying uncommitted work from a worktree).
 - Two separate git repos are involved:
-  - **Tane repo** (this one): the `site/` source, docs, and the screenshot harness.
-  - **Ansible repo**: `~/proyectos/sync/comunes/shared-l2/ansible` — the deploy
-    playbook and the reverse-proxy vhost.
+  - **Tane repo** (this one): the `site/` source, docs, the screenshot harness,
+    and the `site` deploy workflow.
+  - **Ansible repo**: `~/proyectos/sync/comunes/shared-l2/ansible` — the
+    reverse-proxy vhost, and a manual-deploy fallback playbook.
 
 ## One-time setup (already done; only if starting fresh)
 
@@ -51,39 +58,35 @@ inventory shot changes — see the `og-tpl.sh` step in git history; optional.)
 
 ### 2. Commit & land on main
 
-The deploy syncs from the **main checkout** by default, so commit first:
 ```sh
 cd <tane-repo> && git add -A && git commit -m "..."
 git -C ~/proyectos/dev/tane merge --ff-only <your-branch>   # land on main
 git -C ~/proyectos/dev/tane push origin main
 ```
+Pushing to `main` with changes under `site/**` or `docs/**` triggers the `site`
+Forgejo Actions workflow automatically — nothing else to run. Watch it at
+`https://git.comunes.org/comunes/tane/actions` (workflow name `site`), or
+trigger it manually via `workflow_dispatch` if a push didn't touch those paths.
 
-### 3. Deploy
-
-```sh
-cd ~/proyectos/sync/comunes/shared-l2/ansible
-ansible-playbook -i comunes_inventory.ini tane-landing.yml
-```
-This rsyncs `site/` to `groucho:/data/tane-landing/src`, rebuilds the
-Hugo→nginx image there, and recreates the container (only when the source
-changed). `proxies.yml` does **not** need re-running for content changes.
-
-### 4. Verify
+### 3. Verify
 
 ```sh
 curl -sI https://tane.comunes.org/ | head -1                 # 200
 curl -s https://tane.comunes.org/es/about/ | grep -o '<title>[^<]*</title>'
 ```
 
-## Deploying from a git worktree (not the main checkout)
+## Manual deploy fallback (Ansible)
 
-`tane_site_src` defaults to `$HOME/proyectos/dev/tane/site`. To deploy uncommitted
-work from a worktree, point it at that worktree's `site/`:
+Only needed if Forgejo Actions is down, the `GROUCHO_DEPLOY_KEY` secret is
+missing, or you want to push uncommitted work from a worktree:
 ```sh
+cd ~/proyectos/sync/comunes/shared-l2/ansible
 ansible-playbook -i comunes_inventory.ini tane-landing.yml \
-  -e tane_site_src=/abs/path/to/worktree/site
+  -e tane_site_src=/abs/path/to/worktree/site   # omit to use the main checkout
 ```
-Prefer landing on main and deploying from the main checkout for reproducibility.
+This rsyncs `site/` to `groucho:/data/tane-landing/src`, rebuilds the
+Hugo→nginx image there, and recreates the container. `proxies.yml` does
+**not** need re-running for content changes.
 
 ## Gotchas