diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
new file mode 100644
index 0000000..82f1cf2
--- /dev/null
+++ b/.github/workflows/docs.yml
@@ -0,0 +1,71 @@
+name: Docs
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - .github/workflows/publish-docs.yml
+      - common.mk
+      - versions.mk
+      - docs/**
+      - hack/tools/**
+  pull_request:
+    paths:
+      - .github/workflows/publish-docs.yml
+      - common.mk
+      - versions.mk
+      - docs/**
+      - hack/tools/**
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Build mdBook
+    runs-on: ubuntu-latest
+    steps:
+      - name: Clone the code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Setup Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+
+      - name: Configure GitHub Pages
+        if: github.ref == 'refs/heads/main'
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+
+      - name: Build docs
+        run: make -C docs build
+
+      - name: Upload GitHub Pages artifact
+        if: github.ref == 'refs/heads/main'
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        with:
+          path: docs/book
+
+  publish:
+    name: Deploy docs to GitHub Pages
+    if: github.ref == 'refs/heads/main'
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
diff --git a/.github/workflows/publish-docs.yml b/.github/workflows/publish-docs.yml
deleted file mode 100644
index 9a8da62..0000000
--- a/.github/workflows/publish-docs.yml
+++ /dev/null
@@ -1,75 +0,0 @@
-name: Publish Docs
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - .github/workflows/publish-docs.yml
-      - common.mk
-      - versions.mk
-      - docs/**
-      - hack/tools/**
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  publish:
-    name: Publish mdBook to Cloudflare R2
-    runs-on: ubuntu-latest
-    env:
-      AWS_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }}
-      AWS_DEFAULT_REGION: auto
-      CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
-      R2_ENDPOINT: ${{ vars.CLOUDFLARE_R2_ENDPOINT }}
-      R2_BUCKET: ${{ vars.CLOUDFLARE_R2_DOCS_BUCKET }}
-      R2_PREFIX: ${{ vars.CLOUDFLARE_R2_DOCS_PREFIX }}
-    steps:
-      - name: Clone the code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Setup Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
-        with:
-          go-version-file: go.mod
-
-      - name: Build docs
-        run: make -C docs build
-
-      - name: Publish docs
-        run: |
-          set -euo pipefail
-
-          if [ -z "${R2_ENDPOINT}" ]; then
-            if [ -z "${CLOUDFLARE_ACCOUNT_ID}" ]; then
-              echo "CLOUDFLARE_ACCOUNT_ID repository variable is required when CLOUDFLARE_R2_ENDPOINT is not set" >&2
-              exit 1
-            fi
-            R2_ENDPOINT="https://${CLOUDFLARE_ACCOUNT_ID}.r2.cloudflarestorage.com"
-          fi
-          R2_ENDPOINT="${R2_ENDPOINT%/}"
-          endpoint_without_scheme="${R2_ENDPOINT#*://}"
-          if [[ "${endpoint_without_scheme}" == */* ]]; then
-            echo "CLOUDFLARE_R2_ENDPOINT must not include a bucket name or path" >&2
-            echo "Use https://<account-id>.r2.cloudflarestorage.com, not https://<account-id>.r2.cloudflarestorage.com/<bucket>" >&2
-            exit 1
-          fi
-          if [ -z "${R2_BUCKET}" ]; then
-            echo "CLOUDFLARE_R2_DOCS_BUCKET repository variable is required" >&2
-            exit 1
-          fi
-
-          destination="s3://${R2_BUCKET}"
-          if [ -n "${R2_PREFIX}" ]; then
-            destination="${destination}/${R2_PREFIX#/}"
-          fi
-
-          aws s3 sync docs/book "${destination}" \
-            --endpoint-url "${R2_ENDPOINT}" \
-            --delete \
-            --cache-control "public, max-age=300"