diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
new file mode 100644
index 0000000..49132de
--- /dev/null
+++ b/.github/workflows/deploy.yml
@@ -0,0 +1,58 @@
+name: Deploy to GitHub Pages
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+# Minimal top-level permissions: build job only needs to read the repo.
+# Deployment credentials (pages: write, id-token: write) are scoped to
+# the deploy job only, so a compromised build step cannot use them.
+permissions:
+  contents: read
+
+# Only one deployment at a time; don't cancel in-flight deploys.
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Setup Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: '3.2'
+          bundler-cache: true
+
+      - name: Setup Pages
+        id: pages
+        uses: actions/configure-pages@v5
+
+      - name: Build Jekyll site
+        run: bundle exec jekyll build --baseurl "${{ steps.pages.outputs.base_path }}"
+        env:
+          JEKYLL_ENV: production
+
+      - name: Upload Pages artifact
+        uses: actions/upload-pages-artifact@v3
+
+  deploy:
+    # Guard: only deploy from main, even when triggered via workflow_dispatch
+    # on a different branch.
+    if: github.ref == 'refs/heads/main'
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    needs: build
+    permissions:
+      pages: write
+      id-token: write
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v4
diff --git a/_config.yml b/_config.yml
index f682506..24e892a 100755
--- a/_config.yml
+++ b/_config.yml
@@ -5,6 +5,10 @@ keywords: QuantEcon, Quantitative Economics, Economics, Sloan, Alfred P. Sloan F
 timezone: Australia/Sydney
 google_analytics: G-609ZCT25LS
 
+# Site host for absolute URLs (og:url, share links, sitemap). The legacy
+# GitHub Pages builder injected this automatically; the Actions build does not.
+url: "https://quantecon.org"
+
 # baseurl: /quantecon-jekyll-theme/
 baseurl: /
 
diff --git a/sitemap.xml b/sitemap.xml
index 6334f68..c1f3f03 100644
--- a/sitemap.xml
+++ b/sitemap.xml
@@ -8,7 +8,7 @@ search: exclude
 
     {% for page in site.pages %}
     <url>
-        <loc>{{page.url}}</loc>
+        <loc>{{ page.url | absolute_url }}</loc>
         <lastmod>{{site.time | date: '%Y-%m-%d' }}</lastmod>
         <changefreq>daily</changefreq>
         <priority>0.5</priority>
@@ -17,7 +17,7 @@ search: exclude
 
     {% for post in site.posts %}
     <url>
-        <loc>{{post.url}}</loc>
+        <loc>{{ post.url | absolute_url }}</loc>
         <lastmod>{{site.time | date: '%Y-%m-%d' }}</lastmod>
         <changefreq>daily</changefreq>
         <priority>0.5</priority>