diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index fc20d08..b917202 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -4,13 +4,12 @@ name: Deploy (Azure)
 # Container Apps. Auth is GitHub OIDC → Azure (no stored password). See docs/deploy-azure.md for the
 # one-time setup (Entra app + federated credential + role assignment + the repo secrets/vars below).
 #
-# Manual-only for now (run it from the Actions tab). Once the Azure OIDC secrets exist (docs/deploy-azure.md
-# §5), add a `push:` trigger here to auto-deploy on merge to main:
-#   on:
-#     push: { branches: [main] }
-#     workflow_dispatch:
+# Auto-deploys on every push to main (the GitHub OIDC → Azure secrets are configured — see
+# docs/deploy-azure.md §5), and can also be run manually from the Actions tab.
 
 on:
+  push:
+    branches: [main]
   workflow_dispatch:
 
 # Avoid overlapping deploys racing the same apps.