diff --git a/.gitea/workflows/wk-card.yml b/.gitea/workflows/wk-card.yml
index 6d3a584..0668d86 100644
--- a/.gitea/workflows/wk-card.yml
+++ b/.gitea/workflows/wk-card.yml
@@ -2,6 +2,8 @@ name: wk-card
 # Our own trust cards on well-known.online: links, a fresh signed answer, and vouches between our names.
 # Signs inside Actions with the name's main key: factory = SNAIL_KNOWN (uniqornlabz, get), well-known = WK_NSEC.
 on:
+  schedule:
+    - cron: '17 9 * * *'   # daily: answer a fresh challenge for each of our names
   workflow_dispatch:
     inputs:
       key: { description: "which key signs: factory or well-known", required: true, default: factory }
@@ -9,7 +11,28 @@ on:
       action: { description: "answer | links | vouch", required: true, default: answer }
       args: { description: "links: space-separated https URLs; vouch: target name, then the note", required: false, default: "" }
 jobs:
+  daily:
+    if: github.event_name == 'schedule'
+    runs-on: cron
+    timeout-minutes: 5
+    steps:
+      - name: answer for uniqornlabz, get, well-known
+        env:
+          K_FACTORY: ${{ secrets.SNAIL_KNOWN }}
+          K_WK: ${{ secrets.WK_NSEC }}
+        run: |
+          mkdir -p /tmp/wd && cd /tmp/wd
+          npm init -y >/dev/null && npm i --silent @noble/curves@2.4.0 >/dev/null
+          curl -fsSO https://well-known.online/card.mjs
+          umask 077
+          printf '%s' "$K_FACTORY" > f; printf '%s' "$K_WK" > w
+          fail=0
+          for n in uniqornlabz get; do WK_NSEC_FILE=/tmp/wd/f node card.mjs "$n" answer || fail=1; done
+          WK_NSEC_FILE=/tmp/wd/w node card.mjs well-known answer || fail=1
+          rm -f f w
+          exit $fail
   card:
+    if: github.event_name != 'schedule'
     runs-on: ubuntu-latest
     steps:
       - name: run