diff --git a/.gitea/workflows/deploy-site.yml b/.gitea/workflows/deploy-site.yml
index 086957b..992051f 100644
--- a/.gitea/workflows/deploy-site.yml
+++ b/.gitea/workflows/deploy-site.yml
@@ -23,7 +23,11 @@ jobs:
             -e SITE_URL=https://pangolin.yanmeiai.com \
             node:20 bash scripts/ci/compile-site.sh
 
-      - name: Deploy → pangolin1
+      - name: Deploy → Cloudflare Pages
         env:
-          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
-        run: bash scripts/ci/deploy-site.sh
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        run: |
+          docker run --rm -v "$PWD:/w" -w /w \
+            -e CLOUDFLARE_API_TOKEN -e CLOUDFLARE_ACCOUNT_ID \
+            node:20 bash scripts/ci/deploy-site.sh
diff --git a/scripts/ci/deploy-site.sh b/scripts/ci/deploy-site.sh
index 79bec6b..e4914c0 100755
--- a/scripts/ci/deploy-site.sh
+++ b/scripts/ci/deploy-site.sh
@@ -1,32 +1,29 @@
 #!/usr/bin/env bash
-# deploy-site.sh — rsync the built Astro 官网 (web/website/dist/) to the
-# pangolin1 VPS web root (/var/www/pangolin-site). Deploy user is root — the
-# CI deploy key (secrets.DEPLOY_SSH_KEY) is authorized for root on the host.
-# Static files only; nginx/caddy serves them directly, no service restart
-# needed. Assumes it is invoked from the repo root, after compile-site.sh has
-# produced web/website/dist/.
+# deploy-site.sh — 部署构建好的 Astro 官网 (web/website/dist/) 到 Cloudflare Pages。
+#
+# 官网托管在 CF Pages(项目 pangolin-site,自定义域 pangolin.yanmeiai.com),纯静态、
+# 全程 HTTPS、CSP(_headers)自动生效,不落在 VPS 上 —— 故与节点 :443(sing-box)无冲突。
+#
+# 需环境变量:
+#   CLOUDFLARE_API_TOKEN   带 Account > Cloudflare Pages > Edit 权限的 CF token
+#   CLOUDFLARE_ACCOUNT_ID  CF 账户 ID
+# 由 compile-site.sh 先产出 web/website/dist/;从 repo 根调用。
 set -euo pipefail
 
-# shellcheck source=scripts/ci/lib-ssh.sh
-. scripts/ci/lib-ssh.sh
-
-# setup_ssh registers the EXIT cleanup trap itself (before writing the key),
-# so a mid-setup failure still cleans up — see lib-ssh.sh.
-setup_ssh
-
-# Guard against deploying a missing/empty build: `rsync --delete` against an
-# empty source would wipe the live site.
 if [ ! -d web/website/dist ]; then
-  echo "==> deploy-site: web/website/dist/ does not exist — refusing to deploy" >&2
+  echo "==> deploy-site: web/website/dist/ 不存在 — 拒绝部署" >&2
   exit 1
 fi
 if ! find web/website/dist -mindepth 1 -print -quit | grep -q .; then
-  echo "==> deploy-site: web/website/dist/ is empty — refusing to deploy" >&2
+  echo "==> deploy-site: web/website/dist/ 为空 — 拒绝部署" >&2
   exit 1
 fi
 
-DEPLOY_TARGET="root@${DEPLOY_HOST}:/var/www/pangolin-site/"
-echo "==> deploy-site: rsync web/website/dist/ -> ${DEPLOY_TARGET}"
-rsync -az --delete -e "${RSYNC_SSH}" web/website/dist/ "${DEPLOY_TARGET}"
+: "${CLOUDFLARE_API_TOKEN:?deploy-site: CLOUDFLARE_API_TOKEN 未设(需带 Pages:Edit)}"
+: "${CLOUDFLARE_ACCOUNT_ID:?deploy-site: CLOUDFLARE_ACCOUNT_ID 未设}"
+
+echo "==> deploy-site: wrangler pages deploy → project pangolin-site (branch main)"
+npx --yes wrangler@4 pages deploy web/website/dist \
+  --project-name=pangolin-site --branch=main --commit-dirty=true
 
 echo "==> deploy-site: done"