diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index ec091c2..2825ca3 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -1,82 +1,12 @@
-name: Deploy notplanned
+name: notplanned deploy (operator-owned)
 
 on:
-  push:
-    branches: [main]
   workflow_dispatch:
 
 jobs:
-  deploy:
+  note:
     runs-on: ubuntu-latest
     steps:
-      - uses: superfly/flyctl-actions/setup-flyctl@master
-      - name: Ensure public IPs
-        env:
-          FLY_API_TOKEN: ${{ secrets.FLY_INFRA }}
-        run: |
-          set -eu
-          flyctl ips allocate-v4 --shared --app notplanned || true
-          flyctl ips allocate-v6 --app notplanned || true
-      - name: Launch static machine if absent
-        env:
-          FLY_API_TOKEN: ${{ secrets.FLY_INFRA }}
-        run: |
-          set -eu
-          python3 - <<'PY'
-          import base64, json, os, urllib.request, urllib.error
-          app = "notplanned"
-          token = os.environ["FLY_API_TOKEN"]
-          root = f"https://api.machines.dev/v1/apps/{app}"
-          def req(method, path, body=None):
-              data = None if body is None else json.dumps(body).encode()
-              r = urllib.request.Request(root + path, data=data, method=method, headers={
-                  "Authorization": "Bearer " + token,
-                  "Content-Type": "application/json",
-              })
-              try:
-                  with urllib.request.urlopen(r, timeout=60) as resp:
-                      raw = resp.read()
-                      return json.loads(raw or b"{}")
-              except urllib.error.HTTPError as e:
-                  print("Fly API error", e.code, e.read().decode(errors="replace"))
-                  raise
-          machines = req("GET", "/machines")
-          if machines:
-              print("machine already exists:", machines[0].get("id"))
-              raise SystemExit(0)
-          html = base64.b64encode(open("index.html","rb").read()).decode()
-          payload = {
-              "name": "notplanned-web",
-              "region": "sjc",
-              "config": {
-                  "image": "nginx:1.27-alpine",
-                  "env": {"INDEX_B64": html},
-                  "init": {"exec": [
-                      "/bin/sh","-lc",
-                      "printf '%s' \"$INDEX_B64\" | base64 -d > /usr/share/nginx/html/index.html && exec nginx -g 'daemon off;'"
-                  ]},
-                  "guest": {"cpu_kind":"shared","cpus":1,"memory_mb":256},
-                  "services": [{
-                      "protocol":"tcp",
-                      "internal_port":80,
-                      "ports":[
-                          {"port":80,"handlers":["http"]},
-                          {"port":443,"handlers":["tls","http"]}
-                      ]
-                  }]
-              }
-          }
-          m = req("POST", "/machines", payload)
-          print("created machine:", m.get("id"))
-          PY
-      - name: Verify
-        run: |
-          set -eu
-          for i in $(seq 1 40); do
-            if curl -fsS https://notplanned.fly.dev/ | grep -q "we build the features maintainers"; then
-              echo "verified https://notplanned.fly.dev/"
-              exit 0
-            fi
-            sleep 2
-          done
-          exit 1
+      - run: |
+          echo "notplanned deploys are owned by the reviewed Teahub operator workflow."
+          echo "The scout board refreshes every six hours."