diff --git a/.github/workflows/deploy-workers.yml b/.github/workflows/deploy-workers.yml
new file mode 100644
index 0000000..bd5c7e4
--- /dev/null
+++ b/.github/workflows/deploy-workers.yml
@@ -0,0 +1,44 @@
+name: Deploy Cloudflare Worker
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: deploy-cloudflare-worker
+  cancel-in-progress: true
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v7
+        with:
+          submodules: recursive
+
+      - name: Set up Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version-file: package.json
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile --ignore-scripts
+
+      - name: Build frontend
+        run: bun run build:frontend
+
+      - name: Deploy Worker
+        uses: cloudflare/wrangler-action@v4
+        with:
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          command: deploy
+          packageManager: bun
+          workingDirectory: backend
diff --git a/backend/README.md b/backend/README.md
index 295f987..ae16059 100644
--- a/backend/README.md
+++ b/backend/README.md
@@ -52,6 +52,20 @@ cd backend
 bun run deploy
 ```
 
+Pushes to `main` deploy automatically to the Worker's `workers.dev` URL through
+`.github/workflows/deploy-workers.yml`.
+
+Configure these repository secrets under **Settings → Secrets and variables →
+Actions**:
+
+- `CLOUDFLARE_API_TOKEN`: a Cloudflare API token with `Workers Scripts: Edit`,
+  scoped to the deployment account
+- `CLOUDFLARE_ACCOUNT_ID`: the target Cloudflare account ID
+
+Create the token from the Cloudflare dashboard's **Manage Account → Account API
+Tokens** page. Find the account ID on the target account's Cloudflare dashboard
+overview page.
+
 ## Optional auth
 
 Set one of these as Worker secrets:
diff --git a/backend/wrangler.jsonc b/backend/wrangler.jsonc
index 2a97b81..ae322d3 100644
--- a/backend/wrangler.jsonc
+++ b/backend/wrangler.jsonc
@@ -2,6 +2,7 @@
   "$schema": "./node_modules/wrangler/config-schema.json",
   "name": "webmuxd-wisp-demo",
   "main": "src/index.ts",
+  "workers_dev": true,
   "compatibility_date": "2026-03-03",
   "assets": {
     "directory": "../frontend/dist",