diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
new file mode 100644
index 0000000..3407860
--- /dev/null
+++ b/.github/workflows/pages.yml
@@ -0,0 +1,44 @@
+name: pages
+
+# Publishes web/ to GitHub Pages. The page is a single static file with no build
+# step, so this uploads the directory as-is rather than running a toolchain.
+#
+# Only fires when the page itself changes: a Rust-only commit has nothing to
+# republish, and a deploy that runs on every push makes the deploy history
+# useless for answering "when did the page last change?".
+on:
+  push:
+    branches: [master]
+    paths:
+      - "web/**"
+      - ".github/workflows/pages.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+# Never cancel a deploy in flight — a half-published page is worse than a
+# slightly stale one.
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/configure-pages@v5
+
+      - uses: actions/upload-pages-artifact@v3
+        with:
+          path: web
+
+      - id: deployment
+        uses: actions/deploy-pages@v4
diff --git a/README.md b/README.md
index 7068f80..e20fc89 100644
--- a/README.md
+++ b/README.md
@@ -104,15 +104,19 @@ The `HandshakeMessage` struct in `src/scale.rs` is a worked example of SCALE enc
 
 ## Try it in a browser
 
-[`web/index.html`](web/index.html) runs the same checks against a live node from a browser, with the results filling in as they resolve. It is a **JavaScript reimplementation**, not this binary — a browser cannot execute a Rust program — but it speaks the same JSON-RPC, uses the same request ids and failure kinds, and applies the same rule that an unprovable requirement fails rather than passes.
+**→ [emilbob.github.io/substrate-node-probe](https://emilbob.github.io/substrate-node-probe/)**
 
-It is a single self-contained file with no build step:
+The same checks against a live node, with results filling in as they resolve. It is a **JavaScript reimplementation**, not this binary — a browser cannot execute a Rust program — but it speaks the same JSON-RPC, uses the same request ids and failure kinds, and applies the same rule that an unprovable requirement fails rather than passes. Connections go straight from your browser to the node you name; nothing is proxied.
+
+Source is [`web/index.html`](web/index.html), one self-contained file with no build step. To run it locally:
 
 ```bash
 python3 -m http.server -d web 8000    # then open http://127.0.0.1:8000
 ```
 
-To publish it, point GitHub Pages at the `web/` directory, or drop the file on any static host. Note that a page served over `https` cannot open a `ws://` connection to `127.0.0.1` — browsers block that as mixed content — so probing a local dev node means opening the file from disk, or using the CLI.
+Deployed by [`pages.yml`](.github/workflows/pages.yml) on any push that touches `web/`.
+
+A page served over `https` cannot open a `ws://` connection to `127.0.0.1` — browsers block that as mixed content — so probing a **local dev node** means running the page from disk or `http://127.0.0.1`, or just using the CLI, which has no such restriction.
 
 ## Layout