diff --git a/.github/workflows/jekyll-gh-pages.yml b/.github/workflows/jekyll-gh-pages.yml
index c55fef28..7de66f56 100644
--- a/.github/workflows/jekyll-gh-pages.yml
+++ b/.github/workflows/jekyll-gh-pages.yml
@@ -38,6 +38,35 @@ jobs:
         with:
           source: ./
           destination: ./_site
+      - name: Overlay the canonical www bundle
+        shell: bash
+        run: |
+          set -euo pipefail
+          # Publish the canonical bundle alongside whatever the SSG produced.
+          #
+          #   www/public/      -> the servable site root
+          #   www/.well-known/ -> must be reachable at /.well-known/ on this
+          #                       origin (RFC 9116, and RSR check
+          #                       www/.well-known/security.txt)
+          #
+          # Everything else under www/ (dns/, policies/, profiles/, runbooks/,
+          # errors/) is source material and is deliberately NOT published, so
+          # only these two subtrees are copied rather than all of www/.
+          #
+          # Deliberately additive: the generated site is left intact, so this
+          # cannot regress the existing pages.
+          if [ -d www/public ]; then
+            cp -a www/public/. _site/
+          fi
+          if [ -d www/.well-known ]; then
+            mkdir -p _site/.well-known
+            cp -a www/.well-known/. _site/.well-known/
+          fi
+          # Jekyll copied the repository tree, so the bundle *source* would be
+          # served at /www/. The canonical location is the root, above.
+          rm -rf _site/www
+          echo "published tree:"
+          find _site -maxdepth 2 | sort
       - name: Upload artifact
         uses: actions/upload-pages-artifact@v5.0.0
 
diff --git a/.github/workflows/wellknown-enforcement.yml b/.github/workflows/wellknown-enforcement.yml
index 19715849..aeefc4c9 100644
--- a/.github/workflows/wellknown-enforcement.yml
+++ b/.github/workflows/wellknown-enforcement.yml
@@ -6,11 +6,11 @@ on:
   push:
     branches: [main, master]
     paths:
-      - '.well-known/**'
+      - 'www/.well-known/**'
       - 'security.txt'
   pull_request:
     paths:
-      - '.well-known/**'
+      - 'www/.well-known/**'
   schedule:
     # Weekly expiry check
     - cron: '0 9 * * *'
@@ -30,6 +30,7 @@ jobs:
       - name: RFC 9116 security.txt validation
         run: |
           SECTXT=""
+          [ -f "www/.well-known/security.txt" ] && SECTXT="www/.well-known/security.txt"
           [ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"
           [ -f "security.txt" ] && SECTXT="security.txt"
           
@@ -64,9 +65,9 @@ jobs:
       - name: RSR well-known compliance
         run: |
           MISSING=""
-          [ ! -f ".well-known/security.txt" ] && [ ! -f "security.txt" ] && MISSING="$MISSING security.txt"
-          [ ! -f ".well-known/ai.txt" ] && MISSING="$MISSING ai.txt"
-          [ ! -f ".well-known/humans.txt" ] && MISSING="$MISSING humans.txt"
+          for f in security.txt ai.txt humans.txt; do
+            [ -f "www/.well-known/$f" ] || [ -f ".well-known/$f" ] || [ -f "$f" ] || MISSING="$MISSING $f"
+          done
           
           if [ -n "$MISSING" ]; then
             echo "::warning::Missing RSR recommended files:$MISSING"
diff --git a/.well-known/ai.txt b/www/.well-known/ai.txt
similarity index 100%
rename from .well-known/ai.txt
rename to www/.well-known/ai.txt
diff --git a/.well-known/humans.txt b/www/.well-known/humans.txt
similarity index 100%
rename from .well-known/humans.txt
rename to www/.well-known/humans.txt
diff --git a/.well-known/security.txt b/www/.well-known/security.txt
similarity index 100%
rename from .well-known/security.txt
rename to www/.well-known/security.txt