diff --git a/.github/workflows/publish-vps.yml b/.github/workflows/publish-vps.yml
new file mode 100644
index 0000000..b5f80d5
--- /dev/null
+++ b/.github/workflows/publish-vps.yml
@@ -0,0 +1,44 @@
+# appdevelopsk.com (VPS nginx /var/www/html) へ手動で公開する。
+# 既定は dry-run。apply は ken が許可した時だけ(ChatGPT/Codex が勝手に apply しない)。
+# 実行は VPS 上のセルフホストランナー(専用の低権限ユーザー)で、鍵は GitHub に置かない。
+name: publish to VPS
+
+on:
+  workflow_dispatch:
+    inputs:
+      mode:
+        description: 'dry-run = 転送対象の確認のみ / apply = 本番へ反映'
+        type: choice
+        options: [dry-run, apply]
+        default: dry-run
+
+permissions:
+  contents: read
+
+concurrency:
+  group: publish-vps
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    # main 以外の ref からは動かさない(fork や作業ブランチのコードを VPS で走らせない)
+    if: github.ref == 'refs/heads/main'
+    runs-on: [self-hosted, appsite-deploy]
+    timeout-minutes: 15
+    env:
+      APP_SITE_DEPLOY_HOST: local
+      APP_SITE_DEPLOY_ROOT: /var/www/html
+      APP_SITE_RSYNC_FLAGS: -rlcvR --itemize-changes
+    steps:
+      - uses: actions/checkout@v4
+        with: { ref: main }
+      - name: アプリ紹介ページ
+        run: bash scripts/publish_app_discovery.sh --${{ inputs.mode }}
+      - name: ポリシーページ
+        run: bash scripts/publish_stale_policy_pages.sh --${{ inputs.mode }}
+      - name: 本番の検証(apply 時のみ)
+        if: inputs.mode == 'apply'
+        run: |
+          sleep 5
+          bash scripts/check_app_discovery_live.sh
+          bash scripts/publish_stale_policy_pages.sh --check-live
diff --git a/docs/DEPLOY.md b/docs/DEPLOY.md
new file mode 100644
index 0000000..83f9e1b
--- /dev/null
+++ b/docs/DEPLOY.md
@@ -0,0 +1,13 @@
+# 本番反映(appdevelopsk.com)
+
+main へのマージでは本番に反映されない。次のどちらかで反映する。
+
+1. **基本: ken の Mac から**
+   `bash scripts/publish_app_discovery.sh --dry-run` → 確認 → `--apply`、
+   `bash scripts/publish_stale_policy_pages.sh --dry-run|--apply`、
+   検証は `scripts/check_app_discovery_live.sh` と `publish_stale_policy_pages.sh --check-live`。
+2. **ChatGPT/Codex など Mac 以外から: Actions の `publish to VPS`**
+   `gh workflow run publish-vps.yml -f mode=dry-run` → 結果を確認 → ken の許可を得て `-f mode=apply`。
+   main の HEAD だけが対象。`--delete` はしない。apply 後に本番検証まで走る。
+
+禁止: 許可なしの `mode=apply`、App Store(apps.apple.com)リンクの追加(iOS は 404・ADP 終了)。
diff --git a/scripts/publish_app_discovery.sh b/scripts/publish_app_discovery.sh
index b05e1cc..3012ab9 100644
--- a/scripts/publish_app_discovery.sh
+++ b/scripts/publish_app_discovery.sh
@@ -22,7 +22,12 @@ done
 echo "Source checkout: $(git rev-parse --short HEAD 2>/dev/null || echo unknown)"
 echo "Target: $host:$root; mode: $mode"
 # --relative recreates only the listed nested file paths. No --delete.
-rsync -avR --itemize-changes ${flags[@]+"${flags[@]}"} -- "${files[@]}" "$host:$root/"
+# On the self-hosted runner (APP_SITE_DEPLOY_HOST=local) copy straight into the web root.
+dest="$host:$root/"; [[ "$host" == local ]] && dest="$root/"
+# Runner is a non-root user: it cannot chown/utime, so the workflow overrides the flags.
+rsync_flags="${APP_SITE_RSYNC_FLAGS:--avR --itemize-changes}"
+# shellcheck disable=SC2086
+rsync $rsync_flags ${flags[@]+"${flags[@]}"} -- "${files[@]}" "$dest"
 if [[ "$mode" == '--apply' ]]; then
   echo 'Files transferred. Check CDN/VPS output (the publish command does not prove it is live):'
   echo '  bash scripts/check_app_discovery_live.sh'
diff --git a/scripts/publish_stale_policy_pages.sh b/scripts/publish_stale_policy_pages.sh
index 9c4c73b..ef79bc6 100644
--- a/scripts/publish_stale_policy_pages.sh
+++ b/scripts/publish_stale_policy_pages.sh
@@ -87,7 +87,12 @@ flags=(--dry-run)
 echo "Policy recovery: ${#files[@]} already public paths, target $host:$root; mode $mode"
 echo "Source checkout: $(git rev-parse --short HEAD 2>/dev/null || echo unknown)"
 # Non-destructive. Never use --delete, and never publish unpublished paths.
-rsync -avR --itemize-changes ${flags[@]+"${flags[@]}"} -- "${files[@]}" "$host:$root/"
+# On the self-hosted runner (APP_SITE_DEPLOY_HOST=local) copy straight into the web root.
+dest="$host:$root/"; [[ "$host" == local ]] && dest="$root/"
+# Runner is a non-root user: it cannot chown/utime, so the workflow overrides the flags.
+rsync_flags="${APP_SITE_RSYNC_FLAGS:--avR --itemize-changes}"
+# shellcheck disable=SC2086
+rsync $rsync_flags ${flags[@]+"${flags[@]}"} -- "${files[@]}" "$dest"
 if [[ "$mode" == '--apply' ]]; then
   echo 'Upload attempted. Confirm live pages with:'
   echo '  bash scripts/publish_stale_policy_pages.sh --check-live'