diff --git a/.flue/wrangler.jsonc b/.flue/wrangler.jsonc
index 0ce6a227997..1a77173b420 100644
--- a/.flue/wrangler.jsonc
+++ b/.flue/wrangler.jsonc
@@ -189,4 +189,18 @@
 			"head_sampling_rate": 1,
 		},
 	},
+	"secrets": {
+		"required": [
+			"DOCS_FLUE_AI_GATEWAY_ID",
+			"DOCS_FLUE_AI_GATEWAY_AUTH_TOKEN",
+			"DOCS_FLUE_GITHUB_APP_ID",
+			"DOCS_FLUE_GITHUB_APP_PRIVATE_KEY",
+			"DOCS_FLUE_GITHUB_INSTALLATION_ID",
+			"GITHUB_WEBHOOK_SECRET",
+			"GITHUB_ORG_TOKEN",
+			"DOCS_FLUE_CF_TOKEN",
+			"DOCS_FLUE_INTERNAL_TOKEN",
+			"DOCS_FLUE_REVIEW_MODE",
+		],
+	},
 }
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1fe11e07268..1b6de0ef7ab 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,6 +7,7 @@ on:
     paths-ignore:
       - ".flue/**"
       - ".github/workflows/flue-ci.yml"
+      - ".github/workflows/flue-deploy.yml"
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
diff --git a/.github/workflows/flue-deploy.yml b/.github/workflows/flue-deploy.yml
new file mode 100644
index 00000000000..885ead387f0
--- /dev/null
+++ b/.github/workflows/flue-deploy.yml
@@ -0,0 +1,62 @@
+name: Flue Deploy
+
+on:
+  push:
+    branches:
+      - production
+    paths:
+      - ".flue/**"
+      - ".github/workflows/flue-deploy.yml"
+  workflow_dispatch:
+
+concurrency:
+  group: flue-deploy-production
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    if: github.repository == 'cloudflare/cloudflare-docs'
+    name: Deploy
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+        with:
+          version: 11
+
+      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+        with:
+          node-version: 24.x
+          cache: pnpm
+          cache-dependency-path: .flue/pnpm-lock.yaml
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+        working-directory: .flue
+
+      - name: Build
+        run: pnpm run flue:build
+
+      - name: Deploy
+        run: pnpm run flue:deploy
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+
+      - name: Notify Google Chat on failure
+        if: failure()
+        env:
+          WEBHOOK_URL: ${{ secrets.CED_TEAM_ALERTS_CHANNEL_WEBHOOK }}
+          ACTOR: ${{ github.actor }}
+          REPO: ${{ github.repository }}
+          RUN_ID: ${{ github.run_id }}
+        run: |
+          MESSAGE="❌ *Flue Deploy* workflow failed.\nActor: $ACTOR\n<https://github.com/$REPO/actions/runs/$RUN_ID|View run>"
+          JSON_PAYLOAD=$(jq -n --arg text "$MESSAGE" '{text: $text}')
+
+          curl -X POST "$WEBHOOK_URL" \
+            -H "Content-Type: application/json" \
+            -d "$JSON_PAYLOAD"
diff --git a/package.json b/package.json
index f0f1d88a636..dbf98d107a6 100644
--- a/package.json
+++ b/package.json
@@ -32,7 +32,7 @@
 		"flue:dev": "NODE_OPTIONS=--max-old-space-size=8192 pnpm --dir .flue exec vite dev",
 		"flue:dev:wrangler": "pnpm --dir .flue exec vite build && cp -f .flue/.env.local .flue/dist/cloudflare_docs_flue/.dev.vars && pnpm --dir .flue exec wrangler dev --config dist/cloudflare_docs_flue/wrangler.json --remote",
 		"flue:build": "pnpm --dir .flue exec vite build",
-		"flue:deploy": "pnpm run flue:build && pnpm --dir .flue exec wrangler deploy --config dist/cloudflare_docs_flue/wrangler.json --secrets-file .env",
+		"flue:deploy": "pnpm run flue:build && pnpm --dir .flue exec wrangler deploy --config dist/cloudflare_docs_flue/wrangler.json",
 		"flue:clear-r2-pr-data:local": "tsx .flue/bin/clear-r2-pr-data.ts --local",
 		"flue:reset:local": "rm -rf .flue/.wrangler/state .flue/.wrangler/tmp .flue/dist/cloudflare_docs_flue/.wrangler/state && echo 'Cleared local flue dev state (Durable Objects + R2). Stop the dev server before running this.'",
 		"flue:evals": "tsx .flue/bin/run-evals.ts",