diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml
deleted file mode 100644
index 64d0644..0000000
--- a/.github/workflows/casket-pages.yml
+++ /dev/null
@@ -1,38 +0,0 @@
-# SPDX-License-Identifier: MPL-2.0
-name: GitHub Pages
-on:
-  push:
-    branches: [main, master]
-  workflow_dispatch:
-permissions:
-  actions: read
-  contents: read
-  pages: write
-  id-token: write
-concurrency:
-  group: "pages"
-  cancel-in-progress: false
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
-      - name: Setup Pages
-        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
-      - name: Upload artifact
-        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
-        with:
-          path: '.'
-  deploy:
-    environment:
-      name: github-pages
-      url: ${{ steps.deployment.outputs.page_url }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    needs: build
-    steps:
-      - name: Deploy to GitHub Pages
-        id: deployment
-        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
new file mode 100644
index 0000000..5bdfacf
--- /dev/null
+++ b/.github/workflows/pages.yml
@@ -0,0 +1,89 @@
+# SPDX-License-Identifier: MPL-2.0
+name: GitHub Pages (Ddraig SSG)
+
+on:
+  push:
+    branches: [main, master]
+  workflow_dispatch:
+
+permissions:
+  actions: read
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: "pages"
+  cancel-in-progress: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    container:
+      image: ghcr.io/stefan-hoeck/idris2-pack@sha256:f0758996a931fb35d9ecb1de273c4d59dabe2a09b433afc7e357f65a08b7e1ff
+    steps:
+      - name: Checkout Site
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+      - name: Checkout Ddraig SSG
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+        with:
+          repository: hyperpolymath/ddraig-ssg
+          path: .ddraig-ssg
+      - name: Compile Ddraig
+        # Best-effort: a failed Idris build must not stop the repo publishing.
+        continue-on-error: true
+        working-directory: .ddraig-ssg
+        run: idris2 Ddraig.idr -o ddraig
+      - name: Build site
+        continue-on-error: true
+        run: |
+          mkdir -p src
+          if [ ! -f src/index.md ] && [ -f README.md ]; then
+            cp README.md src/index.md
+          elif [ ! -f src/index.md ]; then
+            echo "# ${GITHUB_REPOSITORY}" > src/index.md
+          fi
+          ./.ddraig-ssg/build/exec/ddraig build src _site https://hyperpolymath.github.io/${GITHUB_REPOSITORY#*/}
+      - name: Overlay the canonical www bundle
+        shell: bash
+        run: |
+          set -euo pipefail
+          # Publish the canonical bundle alongside whatever the SSG produced.
+          #
+          #   www/public/      -> the servable site root, used as a fallback
+          #   www/.well-known/ -> must be reachable at /.well-known/ on this
+          #                       origin (RFC 9116, and RSR check
+          #                       www/.well-known/security.txt)
+          #
+          # Everything else under www/ (dns/, policies/, profiles/, runbooks/,
+          # errors/) is source material and is deliberately NOT published, so
+          # only these two subtrees are copied rather than all of www/.
+          mkdir -p _site
+          # -n (no-clobber): a page the SSG did produce always wins, so the
+          # bundle can never regress a working site. It only fills the gaps.
+          if [ -d www/public ]; then
+            cp -an www/public/. _site/
+          fi
+          if [ -d www/.well-known ]; then
+            mkdir -p _site/.well-known
+            cp -a www/.well-known/. _site/.well-known/
+          fi
+          echo "published tree:"
+          find _site -maxdepth 2 | sort
+      - name: Upload artifact
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        with:
+          path: '_site'
+
+  deploy:
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    needs: build
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1
diff --git a/www/public/index.html b/www/public/index.html
new file mode 100644
index 0000000..8e605d4
--- /dev/null
+++ b/www/public/index.html
@@ -0,0 +1,30 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>homebrew-tap</title>
+<style>
+:root{color-scheme:light dark}
+*{box-sizing:border-box}
+body{margin:0;min-height:100vh;display:grid;place-items:center;font:16px/1.6 system-ui,-apple-system,"Segoe UI",Roboto,sans-serif;background:#fafafa;color:#111}
+@media (prefers-color-scheme:dark){body{background:#0d0d0f;color:#e8e8ea}}
+.card{max-width:34rem;padding:2.5rem;text-align:center}
+h1{font-size:clamp(2rem,6vw,3.2rem);margin:0 0 .4rem;letter-spacing:-.02em}
+.dom{font-family:ui-monospace,monospace;font-size:.85rem;opacity:.5}
+p{margin:1.4rem 0 0;opacity:.8}
+.tag{display:inline-block;margin-top:1.8rem;padding:.35rem .9rem;border:1px solid currentColor;border-radius:999px;font-size:.8rem;opacity:.55}
+footer{margin-top:2.6rem;font-size:.76rem;opacity:.4}
+a{color:inherit}
+</style>
+</head>
+<body>
+<main class="card">
+<h1>homebrew-tap</h1>
+<div class="dom">hyperpolymath.github.io/homebrew-tap</div>
+<p>Site in preparation.</p>
+<div class="tag">Coming soon</div>
+<footer>part of the hyperpolymath estate &middot; <a href="/.well-known/security.txt">security.txt</a></footer>
+</main>
+</body>
+</html>