diff --git a/publishing/README.md b/publishing/README.md
index 1b006d6..b87afd4 100644
--- a/publishing/README.md
+++ b/publishing/README.md
@@ -2,7 +2,8 @@
 
 The Markdown in this repository is the single source of truth. This directory
 is the publishing layer that turns it into a member-readable static site and
-puts it on the co-op's Surfer app. Documents are never edited here — a change
+puts it on the co-op's docs Surfer app at https://docs.inference.coop/.
+Documents are never edited here — a change
 to a document is a normal commit or pull request against the Markdown at the
 repository root.
 
@@ -40,18 +41,24 @@ CI-style runs should use, so broken links fail the build.
 CLOUDRON_TOKEN=... publishing/deploy.sh
 ```
 
-Writes the build into the Surfer app (Cloudron app `inference.coop`) at:
+Writes the build into the **docs Surfer app** (Cloudron app `docs.inference.coop`,
+`io.cloudron.surfer`) at:
 
-- `/app/data/public-docs/` — served at **https://docs.inference.coop/**
-- `/app/data/public/docs/` — served at **https://inference.coop/docs/**
+- `/app/data/public/` — served at **https://docs.inference.coop/**
 
-Both are written so the site stays reachable either way; the hostname is the
-canonical one.
+That is now the one canonical location. The docs used to be a pair of
+directories inside the *marketing* Surfer app (`inference.coop`) as well, at
+`/app/data/public-docs/` and `/app/data/public/docs/`; both were deleted when
+this app took over, so `https://inference.coop/docs/` no longer serves the docs
+(nothing on the marketing site linked to it).
+
+Override the destination with `SURFER_APP` (the app's Cloudron location) and
+`DOCS_DEST` (path inside the container) if you ever need to.
 
 ## Automatic rebuilds (push to main)
 
 Two mechanisms keep the site in step with `main`; both run on the agent host
-and neither adds a Cloudron app.
+and deploy into the docs Cloudron app above.
 
 **Polling (running now).** `docs-deploy-poll.service` polls Gitea every 60
 seconds and deploys whenever `main` moves. A push appears on the site within
diff --git a/publishing/deploy.sh b/publishing/deploy.sh
index beb83db..f0b6c9e 100755
--- a/publishing/deploy.sh
+++ b/publishing/deploy.sh
@@ -1,17 +1,23 @@
 #!/usr/bin/env bash
-# Publish the built documentation site to the Cloudron Surfer app.
+# Publish the built documentation site to the docs Surfer app.
 #
-# Surfer serves static files from inside its app container. The build is
-# written to two places:
-#   /app/data/public-docs/   the Surfer site bound to docs.inference.coop
-#                            (served at the root of that hostname)
-#   /app/data/public/docs/   a subdirectory of the marketing site, so the docs
-#                            stay viewable at https://inference.coop/docs/
+# The docs have their OWN Cloudron app now:
+#
+#   Cloudron app: docs.inference.coop  (io.cloudron.surfer, id 85b7ce06-e2af-49a4-bd4f-a9c2e692e3ab)
+#   served at:    https://docs.inference.coop/
+#   on disk:      /app/data/public   (Surfer's "Default" site)
+#
+# They used to be a directory inside the marketing Surfer app
+# (inference.coop, id 55f5f904-...), reachable at /app/data/public-docs and
+# /app/data/public/docs. Both of those copies were deleted once this app was
+# serving, so there is exactly one canonical location and nothing to drift.
 #
 # Mechanism (evidence: Cloudron app "Surfer" io.cloudron.surfer 7.4.1, and
-# repos/website/deploy.sh, which already deploys the marketing site this way):
+# repos/website/deploy.sh, which deploys the marketing site the same way):
 # pipe a tar of the build output into the container via `cloudron exec`, which
 # needs only the Cloudron API token — no WebDAV token, SFTP credentials or SSH.
+# The tar is spooled to a file inside the container first; piping it straight
+# into `tar xf -` twice would leave the second extraction with an empty stdin.
 #
 # Usage:
 #   CLOUDRON_TOKEN=... publishing/deploy.sh
@@ -19,7 +25,8 @@
 # Env:
 #   CLOUDRON_TOKEN   (required) Cloudron API token
 #   CLOUDRON_SERVER  default my.inference.coop
-#   SURFER_APP       default inference.coop (the Surfer app's location)
+#   SURFER_APP       default docs.inference.coop (the docs app's location)
+#   DOCS_DEST        default /app/data/public (Surfer's Default site root)
 #   SITE_DIR         default <repo>/.site-build
 
 set -euo pipefail
@@ -27,9 +34,8 @@ set -euo pipefail
 REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 SITE_DIR="${SITE_DIR:-$REPO_DIR/.site-build}"
 SERVER="${CLOUDRON_SERVER:-my.inference.coop}"
-APP="${SURFER_APP:-inference.coop}"
-DEST_SITE="${DOCS_DEST_SITE:-/app/data/public-docs}"   # docs.inference.coop
-DEST_PATH="${DOCS_DEST_PATH:-/app/data/public/docs}"   # inference.coop/docs/
+APP="${SURFER_APP:-docs.inference.coop}"
+DEST="${DOCS_DEST:-/app/data/public}"
 
 CLOUDRON_BIN="${CLOUDRON_BIN:-$(command -v cloudron || true)}"
 if [ -z "$CLOUDRON_BIN" ] && [ -x "$HOME/.local/bin/cloudron" ]; then
@@ -68,17 +74,14 @@ cat > "$SITE_DIR/meta.json" <<EOF
 EOF
 
 echo "Deploying $SITE_DIR (commit $COMMIT_SHORT) -> $SERVER:$APP"
-echo "  $DEST_SITE  (docs.inference.coop)"
-echo "  $DEST_PATH  (inference.coop/docs/)"
+echo "  $DEST  (docs.inference.coop)"
 
 tar cf - -C "$SITE_DIR" . | \
   "$CLOUDRON_BIN" --server "$SERVER" --token "$CLOUDRON_TOKEN" exec --app "$APP" -- \
     sh -c "set -e
            cat > /tmp/docs-site.tar
-           rm -rf '$DEST_SITE' && mkdir -p '$DEST_SITE' && tar xf /tmp/docs-site.tar -C '$DEST_SITE'
-           rm -rf '$DEST_PATH' && mkdir -p '$DEST_PATH' && tar xf /tmp/docs-site.tar -C '$DEST_PATH'
+           rm -rf '$DEST' && mkdir -p '$DEST' && tar xf /tmp/docs-site.tar -C '$DEST'
            rm -f /tmp/docs-site.tar"
 
 echo "Done:"
 echo "  https://docs.inference.coop/"
-echo "  https://inference.coop/docs/"