diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 4bb6ae1..575948d 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -47,12 +47,21 @@ jobs:
       - name: Build
         run: SITE_NAME=${{ vars.PORTAL_SITE_NAME }} cargo leptos build --release
 
+      # cargo-leptos only builds the leptos bin-target ("portal") - the
+      # question-lint utility binary needs its own plain cargo build.
+      - name: Build question-lint
+        run: cargo build --release --bin question_lint --features ssr
+
       - name: Ship release
         run: |
           set -euo pipefail
           rel="/srv/app/uhhm-portal/releases/${{ github.sha }}"
           mkdir -p "$rel"
           cp "$CARGO_TARGET_DIR/release/portal" "$rel/uhhm-portal"
+          # questions' own CI execs this directly by path (same bare-metal
+          # runner/host as this job, no artifact download needed) instead
+          # of running its own hand-maintained yq/jq subset of these rules.
+          cp "$CARGO_TARGET_DIR/release/question_lint" "$rel/question_lint"
           # site-root ("target/site" in Cargo.toml) is project-relative,
           # not affected by CARGO_TARGET_DIR - only the plain `cargo build`
           # outputs (release/, front/) move with that override.