diff --git a/.github/workflows/site.yml b/.github/workflows/site.yml
index b5e1bc2..32ca28f 100644
--- a/.github/workflows/site.yml
+++ b/.github/workflows/site.yml
@@ -3,8 +3,12 @@ name: Site
 # Checks that the website in site/ builds. It reads the Project file reference
 # from docs/, the screenshots from .github/assets/ and the colours from the
 # desktop app's tokens, so changes there are checked too. Publishing is done by
-# the host serving the custom domain, which builds site/ itself.
+# Vercel, which builds site/ itself on every push to main. The download links
+# are read from the latest release at build time, so publishing a release asks
+# Vercel for a fresh build through its deploy hook.
 on:
+  release:
+    types: [published]
   push:
     branches: [main]
     paths: [site/**, docs/**, .github/assets/**, apps/desktop/src/styles/tokens.css, .github/workflows/site.yml]
@@ -39,3 +43,18 @@ jobs:
       - run: pnpm build
         env:
           GITHUB_TOKEN: ${{ github.token }}
+
+  deploy:
+    name: Rebuild the site for the new release
+    if: github.event_name == 'release'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Call Vercel's deploy hook
+        env:
+          VERCEL_DEPLOY_HOOK: ${{ secrets.VERCEL_DEPLOY_HOOK }}
+        run: |
+          if [[ -z $VERCEL_DEPLOY_HOOK ]]; then
+            echo "::warning::No VERCEL_DEPLOY_HOOK secret: the site keeps the previous release's download links until the next push to main."
+            exit 0
+          fi
+          curl --fail --silent --show-error --retry 3 -X POST "$VERCEL_DEPLOY_HOOK"
diff --git a/site/src/lib/release.ts b/site/src/lib/release.ts
index c59c5e7..544999c 100644
--- a/site/src/lib/release.ts
+++ b/site/src/lib/release.ts
@@ -25,10 +25,10 @@ const patterns = {
 
 let cached: Promise<Release> | undefined;
 
-/** The latest published release, read from GitHub once per build. The site
- * is rebuilt when a release is published (.github/workflows/site.yml), so the
- * links always name that release's files. Without one, or without network,
- * every link goes to the Releases page. */
+/** The latest published release, read from GitHub once per build. Publishing
+ * a release rebuilds the site through Vercel's deploy hook
+ * (.github/workflows/site.yml), so the links name that release's files.
+ * Without one, or without network, every link goes to the Releases page. */
 export function latestRelease(): Promise<Release> {
   cached ??= load();
   return cached;