diff --git a/.gitea/workflows/wk-card.yml b/.gitea/workflows/wk-card.yml
new file mode 100644
index 0000000..6d3a584
--- /dev/null
+++ b/.gitea/workflows/wk-card.yml
@@ -0,0 +1,36 @@
+name: wk-card
+# Our own trust cards on well-known.online: links, a fresh signed answer, and vouches between our names.
+# Signs inside Actions with the name's main key: factory = SNAIL_KNOWN (uniqornlabz, get), well-known = WK_NSEC.
+on:
+  workflow_dispatch:
+    inputs:
+      key: { description: "which key signs: factory or well-known", required: true, default: factory }
+      name: { description: "the signing name (e.g. uniqornlabz)", required: true }
+      action: { description: "answer | links | vouch", required: true, default: answer }
+      args: { description: "links: space-separated https URLs; vouch: target name, then the note", required: false, default: "" }
+jobs:
+  card:
+    runs-on: ubuntu-latest
+    steps:
+      - name: run
+        env:
+          K_FACTORY: ${{ secrets.SNAIL_KNOWN }}
+          K_WK: ${{ secrets.WK_NSEC }}
+          WHICH: ${{ inputs.key }}
+          NAME: ${{ inputs.name }}
+          ACTION: ${{ inputs.action }}
+          ARGS: ${{ inputs.args }}
+        run: |
+          mkdir -p /tmp/wc && cd /tmp/wc
+          npm init -y >/dev/null && npm i --silent @noble/curves@2.4.0 >/dev/null
+          curl -fsSO https://well-known.online/card.mjs
+          umask 077
+          case "$WHICH" in factory) printf '%s' "$K_FACTORY" > k ;; well-known) printf '%s' "$K_WK" > k ;; *) echo "key must be factory or well-known"; exit 2 ;; esac
+          export WK_NSEC_FILE=/tmp/wc/k
+          case "$ACTION" in
+            answer) node card.mjs "$NAME" answer ;;
+            links) set -f; node card.mjs "$NAME" links $ARGS ;;
+            vouch) T="${ARGS%% *}"; N="${ARGS#* }"; [ "$N" = "$ARGS" ] && N=""; node card.mjs "$NAME" vouch "$T" "$N" ;;
+            *) echo "action must be answer, links or vouch"; exit 2 ;;
+          esac
+          rm -f k