diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 3ea6f71f..e0b8948a 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -9,8 +9,6 @@ on:
 
 permissions:
   contents: write
-  pages: write
-  id-token: write
 
 concurrency:
   group: pages
@@ -22,8 +20,6 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       latest: ${{ steps.register.outputs.latest }}
-      artifact_id: ${{ steps.pages.outputs.artifact_id }}
-      published: ${{ steps.publish.outputs.sha }}
     steps:
       - uses: actions/checkout@v4
         with:
@@ -78,56 +74,9 @@ jobs:
               -c user.email='41898282+github-actions[bot]@users.noreply.github.com' \
               commit -qm "Publish $DOCS_VERSION from ${GITHUB_SHA::7}"
           git push -f origin HEAD:gh-pages
-          echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
-      - uses: actions/configure-pages@v5
-      - id: pages
-        uses: actions/upload-pages-artifact@v3
-        with:
-          path: site
-
-  deploy:
-    needs: build
-    runs-on: ubuntu-latest
-    environment:
-      name: github-pages
-      url: ${{ steps.deployment.outputs.page_url }}
-    steps:
-      # Pages keeps the first deployment of a commit, and a release tag sits on the one main
-      # already deployed; the version must be a commit, so it is the one this run published.
-      - id: deployment
-        env:
-          GH_TOKEN: ${{ github.token }}
-          ARTIFACT_ID: ${{ needs.build.outputs.artifact_id }}
-          VERSION: ${{ needs.build.outputs.published }}
-        run: |
-          auth() { printf 'Authorization: Bearer %s\n' "$1"; }
-          api() {
-            curl -sS --fail-with-body -H @<(auth "$GH_TOKEN") \
-              -H 'Accept: application/vnd.github+json' -H 'X-GitHub-Api-Version: 2022-11-28' "$@"
-          }
-          OIDC_TOKEN=$(curl -sS --fail -H @<(auth "$ACTIONS_ID_TOKEN_REQUEST_TOKEN") \
-            "$ACTIONS_ID_TOKEN_REQUEST_URL" | jq -er .value)
-          echo "::add-mask::$OIDC_TOKEN"
-          export OIDC_TOKEN
-          DEPLOYMENT=$(jq -nc --argjson a "$ARTIFACT_ID" \
-            '{artifact_id: $a, pages_build_version: env.VERSION, oidc_token: env.OIDC_TOKEN}' |
-            api -X POST --data @- "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/pages/deployments") ||
-            { echo "::error::Pages deployment $VERSION not created: $DEPLOYMENT"; exit 1; }
-          ID=$(jq -er .id <<<"$DEPLOYMENT")
-          echo "page_url=$(jq -er .page_url <<<"$DEPLOYMENT")" >> "$GITHUB_OUTPUT"
-          for _ in $(seq 120); do
-            STATUS=$(api "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/pages/deployments/$ID" | jq -r .status)
-            case "$STATUS" in
-              succeed) echo "Deployed $VERSION"; exit 0 ;;
-              deployment_failed|deployment_perms_error|deployment_content_failed|deployment_cancelled|deployment_lost)
-                echo "::error::Pages deployment $VERSION: $STATUS"; exit 1 ;;
-            esac
-            sleep 5
-          done
-          echo "::error::Pages deployment $VERSION still $STATUS after 10 minutes"; exit 1
 
   indexnow:
-    needs: [build, deploy]
+    needs: [build]
     # Only `latest` is in the sitemap, so only its rebuild is news.
     if: needs.build.outputs.latest == 'true'
     runs-on: ubuntu-latest
@@ -137,7 +86,9 @@ jobs:
           SITE="https://doc.yarilomail.org"
           KEY="2d4ef23e415848c4aeee9fc1d84ce7c6"
 
-          # Wait until Pages serves the new build, then ping the sitemap URLs.
+          # The cluster's pods pull gh-pages every minute: give them that, then
+          # check the site answers before pinging the sitemap URLs.
+          sleep 90
           for i in $(seq 1 20); do
             curl -sf "${SITE}/${KEY}.txt" | grep -qx "${KEY}" && break
             sleep 15
diff --git a/CLAUDE.md b/CLAUDE.md
index bea923df..094c2b87 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -3,8 +3,9 @@
 Extends the workspace-level `/CLAUDE.md`. All global rules apply.
 
 This repo (`yarilomail/documentation`) is the **source of truth for all public
-Yarilo documentation**, published at https://doc.yarilomail.org via GitHub
-Pages (VitePress 1.6, `srcDir: docs`, images in `docs/public/`). Never edit
+Yarilo documentation**, published at https://doc.yarilomail.org from the
+`gh-pages` branch by the cluster that also serves yarilomail.org (see README,
+Serving; VitePress 1.6, `srcDir: docs`, images in `docs/public/`). Never edit
 `docs/` in the yarilo repo - it no longer exists there.
 
 All documentation is written in **English only**.
@@ -123,7 +124,7 @@ branch. Never edit `gh-pages` by hand.
 - Renaming or moving a published page breaks its URL in every release
   already out. Avoid it; when unavoidable, keep the old path working.
 - `site-root/` - files served from the site root, outside any version
-  (`CNAME`, `robots.txt`, the IndexNow key, `legacy-pages.json`).
+  (`robots.txt`, the IndexNow key, `legacy-pages.json`).
 - `data/settings.yaml` - every documented `yarilo.yaml` setting, keyed by its
   full path (`general.ssl.ssl_min_protocol`). See "Settings" below.
 - `docs/index.md` - landing page; keep it `layout: doc` style (sidebar
diff --git a/site-root/CNAME b/site-root/CNAME
deleted file mode 100644
index 250393dc..00000000
--- a/site-root/CNAME
+++ /dev/null
@@ -1 +0,0 @@
-doc.yarilomail.org