diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
new file mode 100644
index 0000000..7fe58ac
--- /dev/null
+++ b/.github/workflows/deploy.yml
@@ -0,0 +1,123 @@
+name: Deploy
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  build-dmg:
+    runs-on: macos-15
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Swift 6.2
+        uses: swift-actions/setup-swift@v2
+        with:
+          swift-version: '6.2'
+
+      - name: Import code signing certificate
+        env:
+          DEVELOPER_CERT_P12: ${{ secrets.DEVELOPER_CERT_P12 }}
+          DEVELOPER_CERT_PASSWORD: ${{ secrets.DEVELOPER_CERT_PASSWORD }}
+        run: |
+          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
+          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)
+
+          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+
+          echo "$DEVELOPER_CERT_P12" | base64 --decode > $RUNNER_TEMP/cert.p12
+          security import $RUNNER_TEMP/cert.p12 \
+            -P "$DEVELOPER_CERT_PASSWORD" \
+            -A -t cert -f pkcs12 \
+            -k "$KEYCHAIN_PATH"
+          security set-key-partition-list -S apple-tool:,apple: \
+            -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          security list-keychain -d user -s "$KEYCHAIN_PATH"
+
+      - name: Build and package DMG
+        run: scripts/package-dmg.sh
+
+      - name: Notarize DMG
+        env:
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }}
+        run: |
+          DMG_PATH=$(ls .build/package/devtail-*.dmg)
+          xcrun notarytool submit "$DMG_PATH" \
+            --apple-id "$APPLE_ID" \
+            --team-id "$APPLE_TEAM_ID" \
+            --password "$APPLE_APP_PASSWORD" \
+            --wait
+          xcrun stapler staple "$DMG_PATH"
+
+      - name: Rename DMG for stable download URL
+        run: |
+          DMG_PATH=$(ls .build/package/devtail-*.dmg)
+          cp "$DMG_PATH" .build/package/devtail.dmg
+
+      - name: Upload DMG artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: dmg
+          path: .build/package/devtail.dmg
+          retention-days: 1
+
+      - name: Clean up keychain
+        if: always()
+        run: security delete-keychain $RUNNER_TEMP/app-signing.keychain-db || true
+
+  build-web:
+    runs-on: ubuntu-latest
+    needs: build-dmg
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: web/package-lock.json
+
+      - name: Install dependencies
+        working-directory: web
+        run: npm ci
+
+      - name: Build
+        working-directory: web
+        run: npm run build
+
+      - name: Download DMG artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: dmg
+          path: web/dist
+
+      - name: Upload Pages artifact
+        uses: actions/upload-pages-artifact@v3
+        with:
+          path: web/dist
+
+  deploy:
+    runs-on: ubuntu-latest
+    needs: build-web
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v4
diff --git a/.gitignore b/.gitignore
index aff0bb1..88cd62e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,3 +7,4 @@ DerivedData/
 .swiftpm/xcode/package.xcworkspace/contents.xcworkspacedata
 .netrc
 .agents/
+/web/.vite
diff --git a/web/public/menubar.png b/web/public/menubar.png
index c01a4e2..e8791bc 100644
Binary files a/web/public/menubar.png and b/web/public/menubar.png differ
diff --git a/web/src/App.tsx b/web/src/App.tsx
index 640e478..b3c12fe 100644
--- a/web/src/App.tsx
+++ b/web/src/App.tsx
@@ -75,9 +75,6 @@ function App() {
           devtail
         </a>
         <div className="flex items-center gap-6 md:gap-8">
-          <a href="https://github.com" className="ghost-link font-mono">
-            GitHub
-          </a>
           <a href="#download" className="cta-link text-sm font-mono">
             Download
           </a>
@@ -106,7 +103,7 @@ function App() {
               </p>
 
               <div className="hero-stagger mt-8 md:mt-10">
-                <a href="#download" className="cta-link text-base">
+                <a href="./devtail.dmg" download className="cta-link text-base">
                   Download for macOS
                   <span aria-hidden="true">&nbsp;&rarr;</span>
                 </a>
@@ -127,7 +124,7 @@ function App() {
                 <div className="absolute -top-px left-0 h-[2px] w-16 bg-accent" />
                 <div className="overflow-hidden border border-border">
                   <img
-                    src="/menubar.png"
+                    src={`${import.meta.env.BASE_URL}menubar.png`}
                     alt="devtail menu bar interface"
                     className="w-full max-w-sm lg:max-w-none transition-transform duration-500 hover:scale-[1.03]"
                   />
@@ -227,7 +224,8 @@ function App() {
 
           <div className="mt-8 md:mt-12">
             <a
-              href="#download"
+              href="./devtail.dmg"
+              download
               className="inline-flex items-center gap-2.5 border border-background text-background uppercase tracking-[0.1em] font-semibold py-3.5 px-6 text-sm no-underline transition-all duration-150 hover:bg-background hover:text-foreground active:translate-y-px"
             >
               Download for macOS
diff --git a/web/vite.config.ts b/web/vite.config.ts
index 144359a..db57522 100644
--- a/web/vite.config.ts
+++ b/web/vite.config.ts
@@ -4,5 +4,6 @@ import { defineConfig } from "vite";
 
 // https://vite.dev/config/
 export default defineConfig({
+  base: "/devtail/",
   plugins: [react(), tailwindcss()],
 });