diff --git a/.github/workflows/website.yml b/.github/workflows/website.yml
index de7adfdd..f363e7dc 100644
--- a/.github/workflows/website.yml
+++ b/.github/workflows/website.yml
@@ -10,7 +10,7 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: read
+  contents: write
 
 concurrency:
   group: vercel-production
@@ -39,6 +39,18 @@ jobs:
           cp playground/gosqlx.wasm ../website/public/wasm/
           cp playground/wasm_exec.js ../website/public/wasm/
 
+      - name: Commit rebuilt WASM if changed
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add website/public/wasm/gosqlx.wasm website/public/wasm/wasm_exec.js
+          if git diff --cached --quiet; then
+            echo "WASM unchanged, skipping commit"
+          else
+            git commit -m "chore(wasm): rebuild gosqlx.wasm from updated wasm/ source [skip ci]"
+            git push origin main
+          fi
+
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
diff --git a/website/.gitignore b/website/.gitignore
index f6fa644b..6fea418b 100644
--- a/website/.gitignore
+++ b/website/.gitignore
@@ -40,5 +40,5 @@ yarn-error.log*
 *.tsbuildinfo
 next-env.d.ts
 
-# WASM binary (built in CI)
-public/wasm/gosqlx.wasm
+# WASM binary — committed to git so Vercel auto-deploy includes it.
+# website.yml CI rebuilds and recommits when wasm/ source changes.
diff --git a/website/public/wasm/gosqlx.wasm b/website/public/wasm/gosqlx.wasm
new file mode 100755
index 00000000..09b77fda
Binary files /dev/null and b/website/public/wasm/gosqlx.wasm differ