diff --git a/.github/workflows/deploy-on-merge.yml b/.github/workflows/deploy-on-merge.yml
index 90abb37..5721708 100644
--- a/.github/workflows/deploy-on-merge.yml
+++ b/.github/workflows/deploy-on-merge.yml
@@ -1,4 +1,4 @@
-name: Deploy (on merge)
+name: Deploy (on merge + daily)
 
 on:
   push:
@@ -9,6 +9,8 @@ on:
       - "docs/**"
       - "**/*.md"
       - ".github/**"
+  schedule:
+    - cron: "0 11 * * *"
 
 # Serialize fleet deploys so two quick merges can't run Ansible against the
 # same hosts at once. Don't cancel an in-flight deploy mid-run — queue it.
diff --git a/.github/workflows/terraform.yml b/.github/workflows/terraform.yml
index a7f942d..c323a5d 100644
--- a/.github/workflows/terraform.yml
+++ b/.github/workflows/terraform.yml
@@ -6,6 +6,8 @@ on:
     paths:
       - "terraform/**"
       - ".github/workflows/terraform.yml"
+  schedule:
+    - cron: "0 11 * * *"
 
 # Requires these repository secrets:
 #   AGE_SECRET_KEY     — age private key for SOPS decryption
@@ -43,7 +45,7 @@ jobs:
         run: tofu plan -out=tfplan
 
       - name: Upload plan
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        if: (github.event_name == 'push' || github.event_name == 'schedule') && github.ref == 'refs/heads/main'
         uses: actions/upload-artifact@v7
         with:
           name: tfplan
@@ -53,7 +55,7 @@ jobs:
   apply:
     name: Apply
     needs: plan
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    if: (github.event_name == 'push' || github.event_name == 'schedule') && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     environment: production
     steps:
diff --git a/ansible/README.md b/ansible/README.md
index c6abe14..c1cf6f2 100644
--- a/ansible/README.md
+++ b/ansible/README.md
@@ -20,6 +20,17 @@ make deploy
 make deploy-host HOST=helsinki-a
 ```
 
+## CI deploys
+
+`.github/workflows/deploy-on-merge.yml` runs `deploy.yml` over the whole fleet:
+
+- on every merge to `main` (except terraform/docs/workflow-only changes)
+- every day at 11:00 UTC (midday London time during BST), to pull hosts back in line with the repo
+
+Ad-hoc runs against a single host or playbook go through the manual `deploy.yml` workflow.
+
+`.github/workflows/terraform.yml` runs plan + apply on the same daily schedule, as well as on merges touching `terraform/`.
+
 ## Playbooks
 
 | Playbook | Purpose | Usage |