diff --git a/.github/workflows/production-deploy.yaml b/.github/workflows/production-deploy.yaml
new file mode 100644
index 0000000..bc487bb
--- /dev/null
+++ b/.github/workflows/production-deploy.yaml
@@ -0,0 +1,59 @@
+name: Production deploy
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+  repository_dispatch:
+    types:
+      - microcms_update
+
+permissions:
+  contents: read
+
+concurrency:
+  group: production-deploy
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    name: deploy
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: 22.14.0
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Check formatting
+        run: npm run format:check
+
+      - name: Run lint
+        run: npm run lint
+
+      - name: Run tests
+        run: npm test
+
+      - name: Build production bundle
+        run: npm run build
+
+      - name: Check Cloudflare deployment bundle
+        run: npm run cloudflare:check
+
+      - name: Deploy to Cloudflare
+        env:
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+        run: npx wrangler deploy
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index e165a77..e4e25dd 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -64,4 +64,6 @@ Do not maintain a second product story in Web or add pre-rendered example SVGs.
 
 Cloudflare configuration targets the `stack-web` Worker and publishes the combined Vite and VitePress output as static assets. Before a production deployment, run the complete build and dry-run checks, verify the exact Docs and Engine pins, and review the rendered Playground and all four documentation locales.
 
+The `Production deploy` workflow deploys the latest `main` revision after a push to `main`, a manual dispatch from `main`, or a `repository_dispatch` event whose `event_type` is `microcms_update`. The deploy job repeats formatting, lint, test, build, and Cloudflare dry-run gates before publishing with Wrangler. Configure `CLOUDFLARE_ACCOUNT_ID` and `CLOUDFLARE_API_TOKEN` as GitHub Actions secrets; never put either value in the workflow or repository files.
+
 Keep changes focused, use English commit and pull request descriptions, and do not commit credentials, tokens, customer data, signing material, build output, or fetched private resources.