diff --git a/.gitea/workflows/publish.yml b/.gitea/workflows/publish.yml
index 8479d3c..2a5d524 100644
--- a/.gitea/workflows/publish.yml
+++ b/.gitea/workflows/publish.yml
@@ -4,6 +4,14 @@ on:
   push:
     branches:
       - main
+  workflow_dispatch:
+
+# One deploy at a time: `surfer deploy` swaps the site atomically, so two runs
+# racing each other is not corruption, but it is a wasted build and the last
+# swap wins.
+concurrency:
+  group: surfer-datacontroller-io
+  cancel-in-progress: false
 
 jobs:
   Build-and-publish:
@@ -21,5 +29,23 @@ jobs:
       - name: Build
         run: npm run build
 
+      # Deploy tooling pinned to an exact version: the workflow publishes
+      # whatever is committed, and an unpinned `latest` would let a breaking or
+      # compromised upstream release ship straight to the live site.
+      #
+      # `deploy` (v7) replaces the site atomically - it extracts to a staging
+      # folder and swaps it in, so a failed upload leaves the current site
+      # serving.  The v6 `put` this replaces was token authenticated and is
+      # gone; v7 takes the Cloudron username plus an app password for this app.
       - name: Publish
-        run: npx surfer put --token ${{ secrets.SURFER_TOKEN }} --server datacontroller.io public/* /
\ No newline at end of file
+        env:
+          SURFER_PASSWORD: ${{ secrets.SURFER_PASSWORD }}
+          REF_NAME: ${{ gitea.ref_name }}
+          COMMIT_SHA: ${{ gitea.sha }}
+        run: |
+          set -euo pipefail
+          npx --yes @cloudron/surfer@7.2.0 deploy public \
+            --server datacontroller.io \
+            --username allan \
+            --password "$SURFER_PASSWORD" \
+            --message "Build from ${REF_NAME} @ ${COMMIT_SHA:0:8}"