diff --git a/package.json b/package.json
index 3f5a473..9879922 100644
--- a/package.json
+++ b/package.json
@@ -8,7 +8,7 @@
     "website"
   ],
   "scripts": {
-    "build": "npm run build -w @shieldedshell/core && npm run build -w @shieldedshell/cli",
+    "build": "node scripts/build.mjs",
     "test": "npm run test -w @shieldedshell/core",
     "lint": "npm run build",
     "website:dev": "npm run dev -w website",
diff --git a/scripts/build.mjs b/scripts/build.mjs
new file mode 100644
index 0000000..703d2a7
--- /dev/null
+++ b/scripts/build.mjs
@@ -0,0 +1,11 @@
+import { execSync } from "node:child_process";
+
+function run(command) {
+  execSync(command, { stdio: "inherit", shell: true });
+}
+
+if (process.env.CF_PAGES === "1") {
+  run("npm run build -w website");
+} else {
+  run("npm run build -w @shieldedshell/core && npm run build -w @shieldedshell/cli");
+}
diff --git a/website/README.md b/website/README.md
index d3b924a..8d3df1d 100644
--- a/website/README.md
+++ b/website/README.md
@@ -22,7 +22,9 @@ Output: `dist/`.
 
 ## Deploy
 
-Static site suitable for Vercel, Netlify, Cloudflare Pages, or GitHub Pages. Set build command to `npm run build` and output directory to `dist`.
+**Cloudflare Pages (production):** connect the repo root. Cloudflare sets `CF_PAGES=1`, so root `npm run build` builds only the Starlight site into `website/dist`. Set output directory to `website/dist` and Node 22. `wrangler.toml` pins the output path.
+
+**Other hosts:** use `npm run website:build` and publish `website/dist`.
 
 From monorepo root:
 
diff --git a/wrangler.toml b/wrangler.toml
new file mode 100644
index 0000000..8979903
--- /dev/null
+++ b/wrangler.toml
@@ -0,0 +1,4 @@
+# Cloudflare Pages — https://developers.cloudflare.com/pages/functions/wrangler-configuration/
+name = "shielded-shell"
+compatibility_date = "2026-06-15"
+pages_build_output_dir = "./website/dist"