diff --git a/.gitea/workflows/build-deploy.yml b/.gitea/workflows/build-deploy.yml
index 9cae596..d63155c 100644
--- a/.gitea/workflows/build-deploy.yml
+++ b/.gitea/workflows/build-deploy.yml
@@ -2,7 +2,7 @@ name: Build and deploy
 
 on:
   push:
-    branches: [master]
+    branches: [main, staging, devel]
   workflow_dispatch: {}
 
 jobs:
@@ -27,12 +27,23 @@ jobs:
         # directly from a known_hosts file that already trusts both hosts)
         # rather than fetched via ssh-keyscan — no extra network calls, no
         # TOFU, and no risk of tripping aquaria's connection-rate limiting.
+        # KNOWN_HOSTS is shared between prod/test (just more lines in the
+        # same blob); the deploy key itself picks PROD_/TEST_ by branch,
+        # each falling back to the generic DEPLOY_SSH_KEY if unset.
         env:
+          REF_NAME: ${{ github.ref_name }}
+          PROD_DEPLOY_SSH_KEY: ${{ secrets.PROD_DEPLOY_SSH_KEY }}
+          TEST_DEPLOY_SSH_KEY: ${{ secrets.TEST_DEPLOY_SSH_KEY }}
           DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
           KNOWN_HOSTS: ${{ vars.KNOWN_HOSTS }}
         run: |
+          if [ "$REF_NAME" = "main" ]; then
+            KEY="${PROD_DEPLOY_SSH_KEY:-$DEPLOY_SSH_KEY}"
+          else
+            KEY="${TEST_DEPLOY_SSH_KEY:-$DEPLOY_SSH_KEY}"
+          fi
           mkdir -p ~/.ssh
-          printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/deploy_key
+          printf '%s\n' "$KEY" > ~/.ssh/deploy_key
           chmod 600 ~/.ssh/deploy_key
           printf '%s\n' "$KNOWN_HOSTS" >> ~/.ssh/known_hosts
 
@@ -45,15 +56,50 @@ jobs:
         run: pip install --no-cache-dir -r requirements.txt
 
       - name: Build site
-        run: pelican -s publishconf.py
+        # main -> real prod config; staging -> prod-like preview (feeds,
+        # absolute URLs) pointed at the dev webserver; devel (or anything
+        # else) -> bare pelicanconf.py, same as a plain local build.
+        env:
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          if [ "$REF_NAME" = "main" ]; then
+            pelican -s publishconf.py
+          elif [ "$REF_NAME" = "staging" ]; then
+            pelican -s stagingconf.py
+          else
+            pelican
+          fi
 
       - name: Deploy via rsync
+        # main -> production, anything else (i.e. devel/staging) -> test. Host is
+        # required per-target (no generic fallback); port/path/user each
+        # fall back to a shared generic var/secret, then (port only) 22.
         env:
-          DEPLOY_HOST: ${{ vars.DEPLOY_HOST }}
+          REF_NAME: ${{ github.ref_name }}
+          PROD_DEPLOY_HOST: ${{ vars.PROD_DEPLOY_HOST }}
+          TEST_DEPLOY_HOST: ${{ vars.TEST_DEPLOY_HOST }}
+          PROD_DEPLOY_PORT: ${{ vars.PROD_DEPLOY_PORT }}
+          TEST_DEPLOY_PORT: ${{ vars.TEST_DEPLOY_PORT }}
           DEPLOY_PORT: ${{ vars.DEPLOY_PORT }}
-          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
+          PROD_DEPLOY_PATH: ${{ vars.PROD_DEPLOY_PATH }}
+          TEST_DEPLOY_PATH: ${{ vars.TEST_DEPLOY_PATH }}
           DEPLOY_PATH: ${{ vars.DEPLOY_PATH }}
+          PROD_DEPLOY_USER: ${{ secrets.PROD_DEPLOY_USER }}
+          TEST_DEPLOY_USER: ${{ secrets.TEST_DEPLOY_USER }}
+          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
         run: |
+          if [ "$REF_NAME" = "main" ]; then
+            HOST="$PROD_DEPLOY_HOST"
+            PORT="${PROD_DEPLOY_PORT:-$DEPLOY_PORT}"
+            DPATH="${PROD_DEPLOY_PATH:-$DEPLOY_PATH}"
+            USER_="${PROD_DEPLOY_USER:-$DEPLOY_USER}"
+          else
+            HOST="$TEST_DEPLOY_HOST"
+            PORT="${TEST_DEPLOY_PORT:-$DEPLOY_PORT}"
+            DPATH="${TEST_DEPLOY_PATH:-$DEPLOY_PATH}"
+            USER_="${TEST_DEPLOY_USER:-$DEPLOY_USER}"
+          fi
+          echo "Deploying $REF_NAME -> $HOST"
           rsync -avz --delete \
-            -e "ssh -4 -i ~/.ssh/deploy_key -p ${DEPLOY_PORT:-22} -o StrictHostKeyChecking=yes" \
-            output/ "${DEPLOY_USER}@${DEPLOY_HOST}:${DEPLOY_PATH}"
+            -e "ssh -4 -i ~/.ssh/deploy_key -p ${PORT:-22} -o StrictHostKeyChecking=yes" \
+            output/ "${USER_}@${HOST}:${DPATH}"
diff --git a/pelicanconf.py b/pelicanconf.py
index 86afa17..569f7d2 100644
--- a/pelicanconf.py
+++ b/pelicanconf.py
@@ -4,7 +4,7 @@ from __future__ import unicode_literals
 
 AUTHOR = 'haemka'
 SITENAME = '[hɐəmkɑ]'
-SITEURL = ''
+SITEURL = 'http://haemka-de.wd.haemka.lan'
 
 TIMEZONE = 'Europe/Berlin'
 
diff --git a/stagingconf.py b/stagingconf.py
new file mode 100644
index 0000000..6100167
--- /dev/null
+++ b/stagingconf.py
@@ -0,0 +1,21 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*- #
+from __future__ import unicode_literals
+
+# Used for the "staging" branch build: a more production-like preview
+# than the bare pelicanconf.py build used for "devel" (feeds enabled,
+# absolute URLs) but still pointed at the internal dev webserver rather
+# than the real domain.
+
+import os
+import sys
+sys.path.append(os.curdir)
+from pelicanconf import *
+
+SITEURL = 'http://haemka-de.wd.haemka.lan'
+RELATIVE_URLS = False
+
+FEED_ALL_ATOM = 'feeds/all.atom.xml'
+CATEGORY_FEED_ATOM = 'feeds/{slug}.atom.xml'
+
+DELETE_OUTPUT_DIRECTORY = True