diff --git a/.github/workflows/fly-deploy.yml b/.github/workflows/fly-deploy.yml
index 3f863c3..f28a150 100644
--- a/.github/workflows/fly-deploy.yml
+++ b/.github/workflows/fly-deploy.yml
@@ -195,6 +195,18 @@ jobs:
           FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}
         run: fly deploy --remote-only -a "$FLY_APP_NAME"
 
+      - name: Resume app if suspended
+        # A run of crash-restarts (e.g., bad env var) leaves the Fly
+        # app in a "Suspended" state at the edge — even a fresh
+        # healthy deploy can't lift it; the proxy returns 403 with
+        # x-deny-reason: host_not_allowed. Always issuing resume here
+        # is idempotent: if the app is already running, Fly returns
+        # success without side effects.
+        env:
+          FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}
+        run: |
+          fly apps resume "$FLY_APP_NAME" || true
+
       - name: Print live URL
         run: |
           echo "::notice title=Live at::https://$FLY_APP_NAME.fly.dev"