diff --git a/.github/workflows/job-deploy-release.yaml b/.github/workflows/job-deploy-release.yaml
index e5adb6b..b64dfa6 100644
--- a/.github/workflows/job-deploy-release.yaml
+++ b/.github/workflows/job-deploy-release.yaml
@@ -5,6 +5,11 @@ name: Deploy
 # push, no pull_request, no workflow_dispatch. Publishing the release is the
 # one and only "go live" action for this site.
 #
+# A release marked "pre-release" (an rc I tick by hand before publishing)
+# deploys to the dev.cryptos-pki-www.pages.dev branch instead of production,
+# so I can look at it before it reaches cryptos-pki.com. A normal release
+# still deploys to the main branch, unchanged.
+#
 # The workflow creates the Cloudflare Pages project (cryptos-pki-www) the
 # first time, when it doesn't exist yet. Its custom domains (cryptos-pki.com,
 # www.cryptos-pki.com) are still attached once by hand in the Cloudflare
@@ -80,9 +85,27 @@ jobs:
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
           command: pages project create cryptos-pki-www --production-branch=main
 
+      # A pre-release (rc) deploys to the dev branch instead of production, so
+      # I can look at it on dev.cryptos-pki-www.pages.dev before publishing a
+      # real release. Only the deploy target changes -- the build and project
+      # above are the same either way.
+      - name: Determine the deploy branch
+        id: deploy-branch
+        env:
+          PRERELEASE: ${{ github.event.release.prerelease }}
+        run: |
+          set -euo pipefail
+          if [ "$PRERELEASE" = "true" ]; then
+            echo "name=dev" >> "$GITHUB_OUTPUT"
+          else
+            echo "name=main" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Deploy build/client to Cloudflare Pages
         uses: cloudflare/wrangler-action@953926a2e2182532811c01a25e53647d93bf07c0 # v4.1.3
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          command: pages deploy build/client --project-name=cryptos-pki-www --branch=main
+          command: >-
+            pages deploy build/client --project-name=cryptos-pki-www
+            --branch=${{ steps.deploy-branch.outputs.name }}
diff --git a/README.md b/README.md
index 9ea9d84..0d86538 100644
--- a/README.md
+++ b/README.md
@@ -25,9 +25,11 @@ npm run typecheck   # react-router typegen + tsc --noEmit
 
 The site goes live on Cloudflare Pages (project `cryptos-pki-www`, domains `cryptos-pki.com` and
 `www.cryptos-pki.com`) the moment a GitHub Release is published here -- nothing else deploys it.
-The first deploy creates the Pages project if it doesn't exist yet; the custom domains are attached
-once by hand in Cloudflare after that. See [`docs/deploy.md`](docs/deploy.md) for what that build
-contains, the Cloudflare side of the setup, and how to roll back.
+A release marked pre-release deploys to `dev.cryptos-pki-www.pages.dev` instead, so an rc can be
+checked before it goes live; a normal release still deploys to production. The first deploy creates
+the Pages project if it doesn't exist yet; the custom domains are attached once by hand in
+Cloudflare after that. See [`docs/deploy.md`](docs/deploy.md) for what that build contains, the
+Cloudflare side of the setup, and how to roll back.
 
 ## 🙏 Acknowledgements
 
diff --git a/docs/deploy.md b/docs/deploy.md
index ae75d63..7a45bf9 100644
--- a/docs/deploy.md
+++ b/docs/deploy.md
@@ -13,6 +13,20 @@ When a release is published, the workflow checks out that release's tag, runs `n
 folder to Cloudflare Pages with `cloudflare/wrangler-action`, pinned to a specific commit so a
 tag can't silently move the code I'm trusting with deploy credentials.
 
+## Pre-release (rc) builds go to dev, not production
+
+I tick "Set as a pre-release" on a GitHub Release when I'm publishing an rc. The workflow reads
+`github.event.release.prerelease` and picks the Pages branch to deploy to from it:
+
+- **Pre-release (`prerelease: true`):** deploys to the `dev` branch, which Cloudflare Pages serves
+  at `dev.cryptos-pki-www.pages.dev`. I can look at the rc there before it goes anywhere near
+  `cryptos-pki.com`.
+- **Normal release (`prerelease: false`):** deploys to `main`, the project's production branch,
+  exactly as before -- that's what goes live at `cryptos-pki.com`.
+
+Everything else about the run is identical: same checkout, same build, same Cloudflare Pages
+project, same secrets. Only the `--branch` the final `wrangler pages deploy` uses changes.
+
 ## Where it lives
 
 - **Cloudflare Pages project:** `cryptos-pki-www`. Before it deploys, the workflow lists the