diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
new file mode 100644
index 00000000..c333e949
--- /dev/null
+++ b/.github/workflows/docs.yml
@@ -0,0 +1,61 @@
+name: docs
+
+on:
+  push:
+    branches: [ 'release-docs' ]
+
+  pull_request:
+    paths:
+      - 'docs/**'
+
+concurrency:
+  group: docs-${{ github.workflow }}-${{ github.ref_type }}-${{ github.event.pull_request.number || github.ref || github.run_id }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash -euo pipefail {0}
+
+env:
+  GITHUB_REPOSITORY_URL: ${{ github.server_url }}/${{ github.repository }}
+
+jobs:
+
+  docs:
+    name: "docs"
+    runs-on: "ubuntu-24.04"
+    environment:
+      name: ${{ github.ref }}
+
+    steps:
+      - uses: "actions/checkout@v4"
+        with:
+          fetch-depth: 1
+          submodules: true
+
+      - uses: "actions/setup-node@v4"
+        with:
+          node-version: "22"
+
+      - name: "Install deps"
+        run: |
+          cd docs/
+          npm install -g bun
+          bun install
+
+      - name: "Build docs"
+        run: |
+          cd docs/
+          bun prod:build
+
+      - name: "Deploy docs"
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_CLOUDFRONT_DISTRIBUTION_ID: ${{ secrets.AWS_CLOUDFRONT_DISTRIBUTION_ID }}
+          AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
+          AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+        if: ${{ github.ref == 'refs/heads/release-docs' }}
+        run: |
+          cd docs/
+          ./deploy
diff --git a/docs/deploy b/docs/deploy
new file mode 100755
index 00000000..5b88c33d
--- /dev/null
+++ b/docs/deploy
@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+set -euxo pipefail
+shopt -s globstar
+trap "exit" INT
+
+: "${AWS_S3_BUCKET:?The environment variable is required}"
+: "${AWS_CLOUDFRONT_DISTRIBUTION_ID:?The environment variable is required}"
+
+export AWS_MAX_ATTEMPTS=10
+
+pushd "build" >/dev/null
+{
+  # Upload non-HTML files
+  aws s3 sync \
+    --delete \
+    --only-show-errors \
+    --cache-control "max-age=2592000, public" \
+    --metadata-directive REPLACE \
+    --exclude "*.html" \
+    . "s3://${AWS_S3_BUCKET}/"
+
+  # Remove non-HTML files
+  find . -type f \( ! -iname "*.html" \) -exec rm {} \+
+
+  # Remove .html extension
+  rename --filename 's/\.html//' **/*.html || true
+
+  # Upload extensionless HTML files
+  aws s3 sync \
+    --delete \
+    --only-show-errors \
+    --content-type "text/html" \
+    --cache-control "max-age=0, must-revalidate" \
+    --metadata-directive REPLACE \
+    --exclude "*.*" \
+    . "s3://${AWS_S3_BUCKET}/"
+
+  # Update Cloudfront cache
+  aws cloudfront create-invalidation \
+    --no-paginate \
+    --distribution-id "${AWS_CLOUDFRONT_DISTRIBUTION_ID}" \
+    --paths "/*" \
+    >/dev/null
+}
+popd >/dev/null