diff --git a/.bun-version b/.bun-version
new file mode 100644
index 0000000..085c0f2
--- /dev/null
+++ b/.bun-version
@@ -0,0 +1 @@
+1.3.14
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..47276db
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,60 @@
+name: CI
+
+# Build verification only — runs on PRs and pushes to main.
+# Does NOT deploy. Production deploy is gated on publishing a release
+# (see deploy.yml, triggered on `release: published`).
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 24
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version-file: .bun-version
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Build website
+        run: bun run build
+
+      - name: Job summary
+        if: always()
+        run: |
+          bun_version=$(bun --version 2>/dev/null || echo n/a)
+          node_version=$(node --version 2>/dev/null || echo n/a)
+          astro_version=$(node -p "require('astro/package.json').version" 2>/dev/null || echo n/a)
+          pages_built=0
+          [ -d dist ] && pages_built=$(find dist -name '*.html' | wc -l | tr -d ' ')
+          {
+            echo "## 🏗️ Build verification — \`${{ job.status }}\`"
+            echo ""
+            echo "| Item | Value |"
+            echo "| --- | --- |"
+            echo "| Bun | $bun_version |"
+            echo "| Node | $node_version |"
+            echo "| Astro | $astro_version |"
+            echo "| Pages built | $pages_built |"
+            echo "| Commit | \`${GITHUB_SHA::7}\` |"
+          } >> "$GITHUB_STEP_SUMMARY"
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 4b57b9f..2910baf 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -1,8 +1,10 @@
 name: Deploy to GitHub Pages
 
+# Production deploy is gated on publishing a GitHub release.
+# Build verification on PRs / main pushes lives in ci.yml.
 on:
-  push:
-    branches: [main]
+  release:
+    types: [published]
   workflow_dispatch:
 
 permissions:
@@ -19,26 +21,46 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
 
       - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          bun-version: latest
+          bun-version-file: .bun-version
 
       - name: Install dependencies
-        run: bun install
+        run: bun install --frozen-lockfile
 
       - name: Build website
         run: bun run build
 
+      - name: Build summary
+        if: always()
+        run: |
+          bun_version=$(bun --version 2>/dev/null || echo n/a)
+          node_version=$(node --version 2>/dev/null || echo n/a)
+          astro_version=$(node -p "require('astro/package.json').version" 2>/dev/null || echo n/a)
+          pages_built=0
+          [ -d dist ] && pages_built=$(find dist -name '*.html' | wc -l | tr -d ' ')
+          {
+            echo "## 🏗️ Build — \`${{ job.status }}\`"
+            echo ""
+            echo "| Item | Value |"
+            echo "| --- | --- |"
+            echo "| Bun | $bun_version |"
+            echo "| Node | $node_version |"
+            echo "| Astro | $astro_version |"
+            echo "| Pages built | $pages_built |"
+            echo "| Commit | \`${GITHUB_SHA::7}\` |"
+          } >> "$GITHUB_STEP_SUMMARY"
+
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v5
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: ./dist
 
@@ -51,4 +73,20 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
+
+      - name: Deploy summary
+        if: always()
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+          PAGE_URL: ${{ steps.deployment.outputs.page_url }}
+        run: |
+          {
+            echo "## 🚀 Production deploy — \`${{ job.status }}\`"
+            echo ""
+            echo "| Item | Value |"
+            echo "| --- | --- |"
+            echo "| Release | ${RELEASE_TAG:-_manual dispatch_} |"
+            echo "| Site URL | ${PAGE_URL:-n/a} |"
+            echo "| Commit | \`${GITHUB_SHA::7}\` |"
+          } >> "$GITHUB_STEP_SUMMARY"
diff --git a/package.json b/package.json
index 7441141..3cae027 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "libredb-studio-website",
   "type": "module",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "scripts": {
     "dev": "astro dev",
     "build": "node scripts/sync-docker-compose.mjs && astro build",