diff --git a/.claude/launch.json b/.claude/launch.json
deleted file mode 100644
index 13025d2..0000000
--- a/.claude/launch.json
+++ /dev/null
@@ -1,27 +0,0 @@
-{
-	"version": "0.0.1",
-	"configurations": [
-		{
-			"name": "existence-dev",
-			"runtimeExecutable": "npm",
-			"runtimeArgs": [
-				"run",
-				"dev"
-			],
-			"port": 3000,
-			"autoPort": true
-		},
-		{
-			"name": "existence-prod",
-			"runtimeExecutable": "npm",
-			"runtimeArgs": [
-				"run",
-				"start",
-				"--",
-				"-p",
-				"3100"
-			],
-			"port": 3100
-		}
-	]
-}
\ No newline at end of file
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
new file mode 100644
index 0000000..92577f3
--- /dev/null
+++ b/.github/workflows/deploy.yml
@@ -0,0 +1,72 @@
+name: Deploy
+
+# Builds with the Vercel CLI inside GitHub Actions and uploads the prebuilt output.
+# A push to master deploys to production. Each pull request from this repository gets a preview.
+# Needs three repository secrets: VERCEL_TOKEN, VERCEL_ORG_ID, VERCEL_PROJECT_ID.
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: deploy-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+env:
+  VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
+  VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}
+  VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
+  TARGET: ${{ github.event_name == 'pull_request' && 'preview' || 'production' }}
+  # Note: `cond && '' || x` always yields x in Actions, so the empty case must come last.
+  PROD_FLAG: ${{ github.event_name != 'pull_request' && '--prod' || '' }}
+
+jobs:
+  deploy:
+    # Pull requests from forks cannot read secrets, so they are skipped rather than failing.
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    environment:
+      name: ${{ github.event_name == 'pull_request' && 'preview' || 'production' }}
+      url: ${{ steps.deploy.outputs.url }}
+    steps:
+      - name: Check secrets
+        run: |
+          for name in VERCEL_TOKEN VERCEL_ORG_ID VERCEL_PROJECT_ID; do
+            if [ -z "${!name}" ]; then echo "::error::Repository secret $name is not set"; exit 1; fi
+          done
+
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 22
+
+      - name: Install the Vercel CLI
+        run: npm install --global vercel@63
+
+      - name: Pull project settings
+        run: vercel pull --yes --environment=$TARGET --token=$VERCEL_TOKEN
+
+      - name: Build
+        run: vercel build $PROD_FLAG --token=$VERCEL_TOKEN
+
+      # Vercel's Hobby plan blocks deployments whose Git commit author is not a member of the
+      # Vercel account (TEAM_ACCESS_REQUIRED). The CLI reads the author from .git, so remove it
+      # before uploading, and attach the commit as plain metadata instead.
+      - name: Strip Git metadata
+        run: rm -rf .git
+
+      - name: Deploy
+        id: deploy
+        run: |
+          out=$(vercel deploy --prebuilt $PROD_FLAG --meta commit=$GITHUB_SHA --meta ref=$GITHUB_REF_NAME --token=$VERCEL_TOKEN)
+          echo "$out"
+          url=$(echo "$out" | grep -oE 'https://[a-zA-Z0-9.-]+\.vercel\.app' | head -1)
+          echo "url=$url" >> "$GITHUB_OUTPUT"
+          echo "Deployed ($TARGET): $url" >> "$GITHUB_STEP_SUMMARY"
diff --git a/.gitignore b/.gitignore
index 28101f7..bb9fe2d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -38,4 +38,7 @@ next-env.d.ts
 .env*
 .flaskenv*
 !.env.project
-!.env.vault.claude/
+!.env.vault
+
+# local Claude Code settings
+.claude/
diff --git a/README.md b/README.md
index 85bcd4b..a49ff6d 100644
--- a/README.md
+++ b/README.md
@@ -42,8 +42,21 @@ components/
   three/
     LiquidWord.jsx the hero shader
 public/            the ring mark, the Sentient mark, favicon
+.github/workflows/
+  deploy.yml       CI/CD to Vercel
+vercel.json        turns off Vercel's own Git deploys
 ```
 
+## Deploy
+
+The site is hosted on Vercel under the Existence account. Deploys run from GitHub Actions with the Vercel CLI, not from Vercel's Git integration (`vercel.json` turns that off).
+
+- A push to `master` deploys to production.
+- Each pull request from this repository gets a preview deployment. Previews sit behind Vercel's login.
+- The workflow is `.github/workflows/deploy.yml` and needs three repository secrets: `VERCEL_TOKEN`, `VERCEL_ORG_ID` and `VERCEL_PROJECT_ID`.
+
+To deploy by hand from your machine, log in to the Existence Vercel account and run `vercel deploy --prod`.
+
 ## Contact
 
 - GitHub: [github.com/existence-master](https://github.com/existence-master)
diff --git a/vercel.json b/vercel.json
new file mode 100644
index 0000000..618bc1a
--- /dev/null
+++ b/vercel.json
@@ -0,0 +1,5 @@
+{
+	"$schema": "https://openapi.vercel.sh/vercel.json",
+	"framework": "nextjs",
+	"git": { "deploymentEnabled": false }
+}