diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9b843a27d..2535aed18 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,6 +12,9 @@ env:
   FORCE_COLOR: 2
   NODE: 20
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
@@ -37,34 +40,22 @@ jobs:
         run: npm test
 
       - name: Upload docs
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-pages-artifact@v3
         if: github.repository == 'twbs/blog' && github.ref == 'refs/heads/main'
-        with:
-          name: docs
-          path: ./_site/
-          if-no-files-found: error
 
   deploy:
     runs-on: ubuntu-latest
     needs: test
     if: github.repository == 'twbs/blog' && github.ref == 'refs/heads/main'
+    permissions:
+      pages: write
+      id-token: write
 
-    steps:
-      - name: Clone repository
-        uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-
-      - name: Download docs
-        uses: actions/download-artifact@v4
-        with:
-          name: docs
-          path: ./_site/
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
 
-      - name: Deploy
-        uses: peaceiris/actions-gh-pages@v3
-        with:
-          allow_empty_commit: false
-          personal_token: ${{ secrets.PERSONAL_TOKEN }}
-          publish_branch: gh-pages
-          publish_dir: ./_site/
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v4