diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 5c70149..40bb840 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -9,13 +9,35 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
+      # nodejs-api only accepts SSH over its WireGuard tunnel (public :22 was
+      # removed). This peer is scoped to AllowedIPs 10.100.1.3/32 on the
+      # droplet side, so it can only ever reach 10.100.1.1 — nothing else.
+      - name: Bring up WireGuard tunnel
+        run: |
+          sudo apt-get update -y
+          sudo apt-get install -y wireguard-tools
+          umask 077
+          sudo mkdir -p /etc/wireguard
+          cat <<EOF | sudo tee /etc/wireguard/wg0.conf > /dev/null
+          [Interface]
+          PrivateKey = ${{ secrets.CI_WG_PRIVATE_KEY }}
+          Address = 10.100.1.3/32
+
+          [Peer]
+          PublicKey = ${{ secrets.NODEJS_API_WG_PUBLIC_KEY }}
+          Endpoint = 68.183.239.171:51820
+          AllowedIPs = 10.100.1.1/32
+          PersistentKeepalive = 25
+          EOF
+          sudo wg-quick up wg0
+
       # The key below is restricted server-side to only run
       # /opt/new_starr/deploy.sh (see authorized_keys forced-command on the
       # droplet) — it can't run arbitrary commands even if this secret leaks.
       - name: Deploy via SSH
         uses: appleboy/ssh-action@v1
         with:
-          host: ${{ secrets.DEPLOY_HOST }}
+          host: 10.100.1.1
           username: deploy
           key: ${{ secrets.DEPLOY_SSH_KEY }}
           script: deploy