diff --git a/.github/workflows/deploy-site.yml b/.github/workflows/deploy-site.yml
new file mode 100644
index 0000000..40b4f33
--- /dev/null
+++ b/.github/workflows/deploy-site.yml
@@ -0,0 +1,133 @@
+name: Deploy site
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+jobs:
+  build:
+    name: Build site
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: Install dependencies
+        run: npm install
+
+      - name: Build
+        run: npm run build
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: site-build
+          path: dist
+          if-no-files-found: error
+
+  deploy-production:
+    name: Deploy to Production
+    needs: [build]
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    environment: production
+
+    steps:
+      - name: Download artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: site-build
+          path: dist
+
+      - name: Tailscale
+        uses: tailscale/github-action@v2
+        with:
+          oauth-client-id: ${{ secrets.TAILSCALE_OAUTH_CLIENT_ID }}
+          oauth-secret: ${{ secrets.TAILSCALE_OAUTH_CLIENT_SECRET }}
+          tags: tag:ci
+
+      - name: Configure SSH
+        run: |
+          mkdir -p ~/.ssh/
+          echo "$SSH_KEY" > ~/.ssh/production.key
+          chmod 600 ~/.ssh/production.key
+          cat >>~/.ssh/config <<END
+          Host production
+            HostName $SSH_HOST
+            User ci
+            IdentityFile ~/.ssh/production.key
+            StrictHostKeyChecking no
+          END
+        env:
+          SSH_KEY: ${{ secrets.DEPLOYMENT_SSH_KEY }}
+          SSH_HOST: ${{ vars.DEPLOYMENT_HOST }}
+
+      - name: Deploy to deployment host
+        run: rsync -a --delete dist/ production:/usr/share/nginx/jb3.dev/
+
+      - name: Logout from Tailscale & delete ephemeral node
+        run: sudo tailscale logout
+
+  deploy-staging:
+    name: Deploy to Staging
+    needs: [build]
+    runs-on: ubuntu-latest
+    if: github.ref != 'refs/heads/main'
+    environment: staging
+    permissions:
+      deployments: write
+
+    steps:
+      - name: Generate slug for deployment name
+        uses: gacts/github-slug@v1
+        id: slug
+
+      - uses: altinukshini/deployment-action@releases/v1
+        name: Create GitHub deployment
+        id: deployment
+        with:
+          token: "${{ github.token }}"
+          target_url: "https://${{ steps.slug.outputs.branch-name-slug }}.blog-staging.jb3.dev/"
+          environment: staging
+
+      - name: Download artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: site-build
+          path: dist
+
+      - name: Tailscale
+        uses: tailscale/github-action@v2
+        with:
+          oauth-client-id: ${{ secrets.TAILSCALE_OAUTH_CLIENT_ID }}
+          oauth-secret: ${{ secrets.TAILSCALE_OAUTH_CLIENT_SECRET }}
+          tags: tag:ci
+
+      - name: Configure SSH
+        run: |
+          mkdir -p ~/.ssh/
+          echo "$SSH_KEY" > ~/.ssh/production.key
+          chmod 600 ~/.ssh/production.key
+          cat >>~/.ssh/config <<END
+          Host production
+            HostName $SSH_HOST
+            User ci
+            IdentityFile ~/.ssh/production.key
+            StrictHostKeyChecking no
+          END
+        env:
+          SSH_KEY: ${{ secrets.DEPLOYMENT_SSH_KEY }}
+          SSH_HOST: ${{ vars.DEPLOYMENT_HOST }}
+
+      - name: Deploy to deployment host
+        run: rsync -a --delete dist/ production:/usr/share/nginx/jb3.dev-staging/${{ steps.slug.outputs.branch-name-slug }}
+
+      - name: Logout from Tailscale & delete ephemeral node
+        run: sudo tailscale logout
diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
deleted file mode 100644
index 8319cdf..0000000
--- a/.github/workflows/deploy.yaml
+++ /dev/null
@@ -1,54 +0,0 @@
-name: Deploy site
-
-on:
-  push:
-    branches:
-    - main
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    environment: production
-
-    steps:
-    - uses: actions/checkout@v4
-
-    - name: Setup Node.js
-      uses: actions/setup-node@v4
-      with:
-        node-version: '22'
-
-    - name: Install dependencies
-      run: npm install
-
-    - name: Build
-      run: npm run build
-
-    - name: Tailscale
-      uses: tailscale/github-action@v2
-      with:
-          oauth-client-id: ${{ secrets.TAILSCALE_OAUTH_CLIENT_ID }}
-          oauth-secret: ${{ secrets.TAILSCALE_OAUTH_CLIENT_SECRET }}
-          tags: tag:ci
-
-    - name: Configure SSH
-      run: |
-        mkdir -p ~/.ssh/
-        echo "$SSH_KEY" > ~/.ssh/production.key
-        chmod 600 ~/.ssh/production.key
-        cat >>~/.ssh/config <<END
-        Host production
-          HostName $SSH_HOST
-          User ci
-          IdentityFile ~/.ssh/production.key
-          StrictHostKeyChecking no
-        END
-      env:
-        SSH_KEY: ${{ secrets.DEPLOYMENT_SSH_KEY }}
-        SSH_HOST: ${{ vars.DEPLOYMENT_HOST }}
-
-    - name: Deploy to deployment host
-      run: rsync -a --delete dist/ production:/usr/share/nginx/jb3.dev/
-
-    - name: Logout from Tailscale & delete ephemeral node
-      run: sudo tailscale logout