diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7b80ba7..a5c652a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -48,6 +48,10 @@ jobs:
           grep -qv 'PIG Demo — RL environments you can play</title>' dist/demos/wordle/index.html \
             || { echo "demo route kept the homepage title"; exit 1; }
           test -f dist/404.html || { echo "no 404.html"; exit 1; }
+          # sitemap.xml is written by a build step, not by Vite copying public/.
+          # It went missing once because the step was outside `pnpm build`, and
+          # nothing noticed until a 404 on the live host.
+          test -f dist/sitemap.xml || { echo "no sitemap.xml"; exit 1; }
 
       # A blob-backed worker is blocked in production and nowhere else: the
       # site's CSP has no worker-src, so it falls back to default-src 'self'.
diff --git a/deploy/deploy.sh b/deploy/deploy.sh
index dab9c3f..80ffceb 100755
--- a/deploy/deploy.sh
+++ b/deploy/deploy.sh
@@ -22,6 +22,7 @@ cd "$(dirname "$0")/.."
 # The prerender pass is what makes shared links preview correctly. A dist
 # without it builds and serves fine, which is exactly why it needs asserting.
 [ -f dist/404.html ] || { echo "dist/404.html missing — did prerender run?"; exit 1; }
+[ -f dist/sitemap.xml ] || { echo "dist/sitemap.xml missing — run 'pnpm build', not 'vite build'"; exit 1; }
 
 echo "==> preflight on ${HOST}"
 ssh "$HOST" "set -e
@@ -60,6 +61,12 @@ grep -q 'og:title' /tmp/pigdemo-demo.html || { echo "FAILED: demo route has no b
 
 missing=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 30 "$URL/nope-not-a-page")
 echo "    /nope-not-a-page -> $missing"
-[ "$missing" = "404" ] || { echo "WARNING: unknown path returned $missing, expected 404"; }
+[ "$missing" = "404" ] || { echo "FAILED: unknown path returned $missing, expected 404"; exit 1; }
+
+for path in /sitemap.xml /robots.txt /og/wordle.png; do
+  code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 30 "$URL$path")
+  echo "    $path -> $code"
+  [ "$code" = "200" ] || { echo "FAILED: $path returned $code"; exit 1; }
+done
 
 echo "==> live: $URL"
diff --git a/package.json b/package.json
index 9de8f76..18762b2 100644
--- a/package.json
+++ b/package.json
@@ -10,7 +10,7 @@
   "packageManager": "pnpm@11.21.0",
   "scripts": {
     "dev": "vite",
-    "build": "tsc --noEmit && vite build && node scripts/prerender.mjs",
+    "build": "tsc --noEmit && vite build && node scripts/prerender.mjs && node scripts/sitemap.mjs",
     "preview": "vite preview --port 4173",
     "typecheck": "tsc --noEmit",
     "test": "tsx --test src/demos/*/__tests__/*.test.ts",