diff --git a/.github/workflows/hugo_build.yml b/.github/workflows/hugo_build.yml
index db9a1702..c9a42c5e 100644
--- a/.github/workflows/hugo_build.yml
+++ b/.github/workflows/hugo_build.yml
@@ -8,22 +8,27 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+# Avoid parallel Pages deployments when several commits land in a short time.
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
 permissions: read-all
 
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
-  # This workflow contains a single job called "build"
   build:
     # The type of runner that the job will run on
     runs-on: ubuntu-latest
     permissions:
-      contents: write
+      contents: read
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Setup node
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
@@ -41,12 +46,24 @@ jobs:
       - name: Build
         run: npm run build
 
-      - name: Deploy
+      - name: Upload artifact
         # a manual run from another branch only builds
         if: github.ref == 'refs/heads/production'
-        uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5
         with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          publish_dir: ./public
-          commit_message: ${{ github.event.head_commit.message }}
-          cname: cloudnative-pg.io
+          path: public
+
+  deploy:
+    if: github.ref == 'refs/heads/production'
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5
diff --git a/README.md b/README.md
index 02ec1f60..8a3347a2 100644
--- a/README.md
+++ b/README.md
@@ -132,22 +132,16 @@ to the new site. No new versions are added there.
 Changes that have been merged into `main` are not yet visible on the website. To
 publish them, they need to be merged into the `production` branch.
 
-Please publish to `production` by doing a direct merge into the branch from
-`main`.
+Please publish to `production` by fast-forwarding it to `main`
+(`git merge --ff-only main`), as the branch requires a linear history.
 This needs to be done by an administrator.
 
-If you try to merge or cherry-pick into `production` and you don't have the
-right permissions, `git` will alert you about the branch protections.
-
-``` sh
-remote: error: GH006: Protected branch update failed for refs/heads/production.
-remote: error: Changes must be made through a pull request.
-```
+If you try to push to `production` without the right permissions, GitHub
+rejects the push with a "Repository rule violations" error.
 
 Please **don't make a pull request**. Instead, get an administrator to make the
 needed changes, or to make you an administrator. A pull request would create
 unnecessary discrepancies between `main` and `production`.
 
-Once a commit is merged to `production`, github will trigger the necessary
-`hugo_build` and `pages-build-deployment` workflows that will update
-[cloudnative-pg.io](https://cloudnative-pg.io).
+Once a commit is merged to `production`, github will trigger the `hugo_build`
+workflow that will update [cloudnative-pg.io](https://cloudnative-pg.io).