diff --git a/.forgejo/workflows/deploy-content.yml b/.forgejo/workflows/deploy-content.yml
new file mode 100644
index 0000000..cffab40
--- /dev/null
+++ b/.forgejo/workflows/deploy-content.yml
@@ -0,0 +1,34 @@
+name: Deploy content to live site
+
+# Hand-edited site content lives in this repo. Every push to main
+# rsyncs it into /srv/zddc/ on the deploy host (Caddy bind-mount).
+# /releases/ is owned by the ZDDC source repo's pipeline and is
+# excluded from this rsync; it's untouched here.
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  deploy:
+    runs-on: host
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Rsync content → /srv/zddc/
+        run: |
+          set -eu
+          rsync -av --delete-after \
+              --exclude='/releases/' \
+              --exclude='/.git*' \
+              --exclude='/.forgejo*' \
+              --exclude='/README.md' \
+              --exclude='/LICENSE' \
+              "$GITHUB_WORKSPACE/" /srv/zddc/
+
+      - name: Verify
+        run: |
+          curl -ksI --resolve zddc.varasys.io:8443:127.0.0.1 \
+              https://zddc.varasys.io:8443/ | head -3