diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 0ed3088..ad1df6d 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -42,3 +42,19 @@ jobs:
             -H "Authorization: token ${{ secrets.PACKAGES_TOKEN }}" \
             --upload-file dist-cdn/buuh.js.map \
             "https://project.uhhm.no/api/packages/uhhm/generic/buuh-cdn/${VERSION}/buuh.js.map"
+
+      - name: publish to cdn.uhhm.no (git-pages, incremental)
+        run: |
+          VERSION="${GITHUB_REF_NAME#v}"
+          mkdir cdn
+          cp dist-cdn/buuh.js "cdn/buuh@${VERSION}.js"
+          cp dist-cdn/buuh.js.map "cdn/buuh@${VERSION}.js.map"
+          cp dist-cdn/buuh.js cdn/buuh.js
+          cp dist-cdn/buuh.js.map cdn/buuh.js.map
+          tar -czf cdn.tar.gz -C cdn .
+          # PATCH = incremental: earlier versions stay published forever
+          curl --fail -sS -X PATCH "https://cdn.uhhm.no/" \
+            -H "Content-Type: application/x-tar+gzip" \
+            -H "Forge-Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+            --data-binary @cdn.tar.gz \
+            -w "cdn: %{http_code}\n"
diff --git a/docs/publishing.md b/docs/publishing.md
index ea1a8a2..ab3bfe1 100644
--- a/docs/publishing.md
+++ b/docs/publishing.md
@@ -48,26 +48,15 @@ MIME checking). So an import map cannot point at Gitea directly.
 
 What works instead, in order of effort:
 
-**a. The single-file bundle + any static host (recommended).**
-`npm run bundle` produces `dist-cdn/buuh.js` — the whole framework as
-one minified ES module with named exports. The release workflow uploads
-it to Gitea's generic package store as the archive of record; to make it
-importable, serve a copy from any host that sends
-`text/javascript` + CORS. Since you run uhhm.no, that's a few lines of
-Caddy:
-
-```
-cdn.uhhm.no {
-  root * /srv/cdn
-  file_server
-  header Access-Control-Allow-Origin *
-  header /buuh@* Cache-Control "public, max-age=31536000, immutable"
-}
-```
-
-Drop each release in as `buuh@8.0.0.js` (a `curl` from the generic
-package URL, or an extra `scp` step in the workflow), and every project
-on earth can do:
+**a. cdn.uhhm.no — live, and it's just a pages site (recommended).**
+`https://cdn.uhhm.no/buuh@<version>.js` is real: the CDN is a git-pages
+site (see uhhm/infrastructure PAGES.md) — an A record, an allowlist TXT
+pointing at this repo, and the release workflow PATCHing each version's
+bundle in (PATCH is incremental, so old versions persist forever). A
+`_headers` file provides `Access-Control-Allow-Origin: *` everywhere,
+year-long immutable caching on versioned files, and short caching on
+`buuh.js` (the latest alias) and the index. No separate web server, no
+Caddy site config.
 
 ```html
 <script type="importmap">
@@ -78,8 +67,6 @@ on earth can do:
 </script>
 ```
 
-That is the zero-build story with your own domain on it.
-
 **b. Self-hosted esm.sh.** esm.sh is open source and can be pointed at
 a custom npm registry — run it against the Gitea endpoint and you get
 real CDN semantics (per-package URLs, versioning, bundling) for