diff --git a/.deploy.env.example b/.deploy.env.example
index a6a8fcf..7f6b6d8 100644
--- a/.deploy.env.example
+++ b/.deploy.env.example
@@ -1,7 +1,10 @@
-# Deploy credentials for inference.coop Surfer (WebDAV).
-# This file is gitignored — never commit it.
-# Copy to .deploy.env and fill in the values.
+# Deploy credentials for inference.coop Surfer.
+#
+# Deploys now use `cloudron exec` (see deploy.sh), so the only credential is the
+# Cloudron API token — no WebDAV token is needed.
+#
+# Copy to .deploy.env and fill in the value (this file is gitignored).
 
-SURFER_URL=https://inference.coop/_webdav/
-SURFER_USER=
-SURFER_TOKEN=
+CLOUDRON_TOKEN=
+CLOUDRON_SERVER=my.inference.coop
+SURFER_APP=inference.coop
diff --git a/deploy.sh b/deploy.sh
old mode 100644
new mode 100755
index fb4e253..997c916
--- a/deploy.sh
+++ b/deploy.sh
@@ -1,60 +1,42 @@
 #!/usr/bin/env bash
-# Deploy the Inference Cooperative landing page to Cloudron Surfer via WebDAV.
+# Deploy the Inference Cooperative landing page to Cloudron Surfer.
+#
+# Uses `cloudron exec` to write files directly into Surfer's /app/data/public
+# directory — no WebDAV token or SSH required. Auth is the Cloudron CLI token
+# (read from env as CLOUDRON_TOKEN, the same token the CLI uses everywhere else).
 #
 # Usage:
-#   ./deploy.sh
+#   CLOUDRON_TOKEN=... ./deploy.sh
 #
-# Credentials are read from .deploy.env (gitignored) or environment variables:
-#   SURFER_URL       WebDAV base URL (e.g. https://inference.coop/_webdav/)
-#   SURFER_USER      WebDAV username
-#   SURFER_TOKEN     WebDAV password / app token
-#
-# The script uploads the contents of landing-page/ (index.html, favicon.svg,
-# fonts/) to the Surfer instance, creating directories as needed and
-# overwriting existing files.
+# The script uploads the repo's site assets (index.html, favicon.svg, fonts/,
+# thanks/, and the static assets) to the Surfer instance.
 
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-SITE_DIR="$SCRIPT_DIR/landing-page"
 
-# Load credentials from .deploy.env if present
-if [[ -f "$SCRIPT_DIR/.deploy.env" ]]; then
-  set -a
-  # shellcheck disable=SC1091
-  source "$SCRIPT_DIR/.deploy.env"
-  set +a
-fi
+: "${CLOUDRON_TOKEN:?CLOUDRON_TOKEN is required (the Cloudron API token)}"
 
-: "${SURFER_URL:?SURFER_URL is required (set in .deploy.env or env)}"
-: "${SURFER_USER:?SURFER_USER is required}"
-: "${SURFER_TOKEN:?SURFER_TOKEN is required}"
+SERVER="${CLOUDRON_SERVER:-my.inference.coop}"
+APP="${SURFER_APP:-inference.coop}"   # Surfer app location
 
-# Strip trailing slash for clean joining
-SURFER_URL="${SURFER_URL%/}"
+# Files that make up the live site, mirrored in /app/data/public/.
+SITE_FILES=(
+  index.html
+  favicon.svg
+  robots.txt
+  sitemap.xml
+  metagov-earth.png
+  fonts
+  thanks
+)
 
-AUTH=(-u "$SURFER_USER:$SURFER_TOKEN")
+echo "Deploying to $SERVER ($APP) via cloudron exec"
 
-echo "Deploying $SITE_DIR -> $SURFER_URL"
-
-# 1. Create all directories (MKCOL). WebDAV requires parent collections to
-#    exist before files can be uploaded into them.
-find "$SITE_DIR" -type d | while read -r dir; do
-  rel="${dir#"$SITE_DIR"}"
-  # Skip the root (rel is empty)
-  [[ -z "$rel" ]] && continue
-  dest="$SURFER_URL/$rel"
-  echo "  mkdir $rel"
-  # MKCOL returns 405 if the collection already exists — that's fine.
-  curl -sS -X MKCOL "${AUTH[@]}" "$dest" >/dev/null 2>&1 || true
-done
-
-# 2. Upload every file, preserving relative paths.
-find "$SITE_DIR" -type f | while read -r file; do
-  rel="${file#"$SITE_DIR"/}"
-  dest="$SURFER_URL/$rel"
-  echo "  -> $rel"
-  curl -sS -f -T "$file" "${AUTH[@]}" "$dest"
-done
+# Tar the site files and extract into Surfer's public dir on the server.
+# cloudron exec is not a TTY, so `tar -x` works over the stdin pipe.
+tar cf - "${SITE_FILES[@]}" | \
+  cloudron --server "$SERVER" --token "$CLOUDRON_TOKEN" exec --app "$APP" -- \
+    sh -c 'tar xf - -C /app/data/public'
 
 echo "Deploy complete."