diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 75bd536..2e93782 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,6 +15,8 @@ jobs:
   build:
     name: typecheck + build
     runs-on: ubuntu-latest
+    outputs:
+      sha: ${{ steps.set-sha.outputs.sha }}
     steps:
       - name: Checkout
         uses: actions/checkout@v5
@@ -27,22 +29,82 @@ jobs:
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
+      # Real build: typecheck + turbo across all workspace packages.
       - name: Typecheck
         run: bun run typecheck
 
       - name: Build web
         run: bun --cwd apps/web run build
 
+      # Smoke: verify the MCP server + resources load and the indexer/module
+      # graph resolves. Requires no external services (Redis/Postgres) — pure
+      # module load + in-memory smoke test.
       - name: MCP smoke test
         run: bun --cwd apps/mcp run smoke
 
+      # Unit tests across all packages + apps. CI has no Postgres/Redis, so
+      # tests use bun:test module mocking to stub @mcpedia/db, @mcpedia/queue,
+      # and @mcpedia/embeddings — no live I/O.
       - name: Test
         run: bun run test
 
       # Upload the built .next directory as a deploy artifact.
-      # The VPS deploy step copies this directly — no build needed on VPS.
+      # The deploy job copies this directly to the VPS — no build needed there.
+      - name: Set SHA output
+        id: set-sha
+        run: echo "sha=${GITHUB_SHA::12}" >> $GITHUB_OUTPUT
+
       - name: Upload web build artifact
         uses: actions/upload-artifact@v4
         with:
           name: mcpedia-web-build
           path: apps/web/.next/
+          retention-days: 1
+
+  deploy:
+    name: deploy to VPS
+    needs: build
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Download build artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: mcpedia-web-build
+          path: .next
+
+      - name: Copy pre-built .next to VPS
+        uses: appleboy/scp-action@v1
+        with:
+          host: ${{ secrets.SSH_DEPLOY_HOST }}
+          port: ${{ secrets.SSH_DEPLOY_PORT }}
+          username: ${{ secrets.SSH_DEPLOY_USER }}
+          key: ${{ secrets.SSH_DEPLOY_KEY }}
+          source: ".next/*"
+          target: "/home/code/mcpedia/apps/web/.next"
+
+      - name: Deploy to VPS over SSH
+        uses: appleboy/ssh-action@v1
+        with:
+          host: ${{ secrets.SSH_DEPLOY_HOST }}
+          port: ${{ secrets.SSH_DEPLOY_PORT }}
+          username: ${{ secrets.SSH_DEPLOY_USER }}
+          key: ${{ secrets.SSH_DEPLOY_KEY }}
+          envs: SSH_DEPLOY_HOST
+          script: |
+            set -e
+            cd /home/code/mcpedia
+
+            # Pull latest code (for content, .env, and non-web changes)
+            git pull origin main
+            /home/code/.bun/bin/bun install --frozen-lockfile
+            /home/code/.bun/bin/bun run scripts/indexer.ts
+
+            # The .next/ was just copied from CI (pre-built, no build on VPS)
+            # Restart services to pick up the new build
+            sudo systemctl restart mcpedia-web mcpedia-api mcpedia-mcp mcpedia-worker
+            sleep 3
+            systemctl --no-pager status mcpedia-web mcpedia-api mcpedia-mcp mcpedia-worker --no-legend
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
deleted file mode 100644
index 6210cd4..0000000
--- a/.github/workflows/deploy.yml
+++ /dev/null
@@ -1,59 +0,0 @@
-name: Deploy
-
-on:
-  workflow_run:
-    workflows: ["CI"]
-    types: [completed]
-    branches: [main]
-
-concurrency:
-  group: deploy-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  deploy:
-    name: deploy to VPS
-    if: ${{ github.event.workflow_run.conclusion == 'success' }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-
-      - name: Download build artifact
-        uses: actions/download-artifact@v4
-        with:
-          name: mcpedia-web-build
-          path: .next
-
-      - name: Copy pre-built .next to VPS
-        uses: appleboy/scp-action@v1
-        with:
-          host: ${{ secrets.SSH_DEPLOY_HOST }}
-          port: ${{ secrets.SSH_DEPLOY_PORT }}
-          username: ${{ secrets.SSH_DEPLOY_USER }}
-          key: ${{ secrets.SSH_DEPLOY_KEY }}
-          source: ".next/*"
-          target: "/home/code/mcpedia/apps/web/.next"
-
-      - name: Deploy to VPS over SSH
-        uses: appleboy/ssh-action@v1
-        with:
-          host: ${{ secrets.SSH_DEPLOY_HOST }}
-          port: ${{ secrets.SSH_DEPLOY_PORT }}
-          username: ${{ secrets.SSH_DEPLOY_USER }}
-          key: ${{ secrets.SSH_DEPLOY_KEY }}
-          envs: SSH_DEPLOY_HOST
-          script: |
-            set -e
-            cd /home/code/mcpedia
-
-            # Pull latest code (for content, .env, and non-web changes)
-            git pull origin main
-            /home/code/.bun/bin/bun install --frozen-lockfile
-            /home/code/.bun/bin/bun run scripts/indexer.ts
-
-            # The .next/ was just copied from CI (pre-built, no build on VPS)
-            # Restart services to pick up the new build
-            sudo systemctl restart mcpedia-web mcpedia-api mcpedia-mcp mcpedia-worker
-            sleep 3
-            systemctl --no-pager status mcpedia-web mcpedia-api mcpedia-mcp mcpedia-worker --no-legend