diff --git a/.github/workflows/close-solved.yml b/.github/workflows/close-solved.yml
index 8d7d0d7..4980bb1 100644
--- a/.github/workflows/close-solved.yml
+++ b/.github/workflows/close-solved.yml
@@ -28,7 +28,7 @@ jobs:
       - uses: oven-sh/setup-bun@v2
 
       # No install step: the script only uses Bun builtins + fetch.
-      - run: bun scripts/close-solved.ts
+      - run: bun apps/cli/close-solved.ts
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           DRY_RUN: ${{ inputs.dry_run }}
diff --git a/.github/workflows/close-topics.yml b/.github/workflows/close-topics.yml
index 02704d9..3eead0a 100644
--- a/.github/workflows/close-topics.yml
+++ b/.github/workflows/close-topics.yml
@@ -38,7 +38,7 @@ jobs:
       - uses: oven-sh/setup-bun@v2
 
       # No install step: the script only uses Bun builtins + fetch.
-      - run: bun scripts/close-topics.ts
+      - run: bun apps/cli/close-topics.ts
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           DRY_RUN: ${{ inputs.dry_run }}
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 8d934fd..7c8f7ee 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -1,4 +1,4 @@
-name: Deploy Docs
+name: Deploy
 
 on:
   push:
@@ -10,8 +10,11 @@ permissions:
   pages: write
   id-token: write
 
+# The Worker deploy is idempotent (wrangler uploads the whole bundle), so on a
+# burst of pushes only the last one matters: cancel-in-progress is correct for
+# both the Pages build and the Worker job.
 concurrency:
-  group: pages
+  group: deploy
   cancel-in-progress: true
 
 jobs:
@@ -31,7 +34,7 @@ jobs:
 
       - uses: actions/upload-pages-artifact@v3
         with:
-          path: dist
+          path: apps/docs/dist
 
   deploy:
     needs: build
@@ -42,3 +45,24 @@ jobs:
     steps:
       - id: deployment
         uses: actions/deploy-pages@v4
+
+  # Deploys on every main push (not path-filtered): apps/api/data/schedule.json
+  # is bundled at deploy time, and re-deploying an unchanged Worker is a no-op.
+  # Needs repo secrets CLOUDFLARE_API_TOKEN (Workers Scripts: Edit) and
+  # CLOUDFLARE_ACCOUNT_ID.
+  deploy-api:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: oven-sh/setup-bun@v2
+
+      - run: bun install --frozen-lockfile
+
+      # DST cron guards must hold before the Worker ships.
+      - run: bun run api:test
+
+      - run: bun run api:deploy
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}