diff --git a/.gitignore b/.gitignore
index b1640b5..aaa8539 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,4 @@ node_modules
 dist
 .env
 .env.local
+.netlify
diff --git a/deploy.sh b/deploy.sh
new file mode 100755
index 0000000..6b33c21
--- /dev/null
+++ b/deploy.sh
@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# Deploys Learning Lab Express to Netlify production (https://express.bawana.com).
+# The site has no Git integration: it is built here, with .env.production, and the dist folder is uploaded.
+#
+#   ./deploy.sh          test, build and deploy to production
+#   ./deploy.sh --draft  same, but to a draft URL for checking first
+set -euo pipefail
+
+SITE_ID="574369ce-8199-498e-bb7c-0a19b8684ab2" # Netlify project "lab-express"
+
+cd "$(dirname "$0")"
+
+if ! command -v netlify >/dev/null; then
+  echo "Netlify CLI not found. Install it with: npm install -g netlify-cli" >&2
+  exit 1
+fi
+if [ ! -f .env.production ]; then
+  echo ".env.production is missing: the build would use the dev Clerk key." >&2
+  exit 1
+fi
+if [ -n "$(git status --porcelain -- src index.html package.json package-lock.json netlify.toml)" ]; then
+  echo "Warning: there are uncommitted changes; they will be deployed too." >&2
+fi
+
+echo "› Running tests"
+npm test
+
+echo "› Building"
+npm run build
+
+MESSAGE="$(git log -1 --pretty='%h %s')"
+if [ "${1:-}" = "--draft" ]; then
+  echo "› Deploying a draft"
+  netlify deploy --no-build --dir dist --site "$SITE_ID" --message "Draft: $MESSAGE"
+else
+  echo "› Deploying to production"
+  netlify deploy --prod --no-build --dir dist --site "$SITE_ID" --message "$MESSAGE"
+fi