diff --git a/.gitignore b/.gitignore
index b63d8e7..ff8b10e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,4 @@
 __pycache__/
 *.pyc
 .DS_Store
+.cf_token
diff --git a/Dockerfile b/Dockerfile
index 4403d6e..5dc0125 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,12 @@
-FROM python:3.12-slim
+FROM python:3.12 AS build
 WORKDIR /app
 COPY requirements.txt .
-RUN pip install --no-cache-dir -r requirements.txt gunicorn==23.0.0
+RUN pip wheel --no-cache-dir --wheel-dir /wheels -r requirements.txt gunicorn==23.0.0
+
+FROM python:3.12-slim
+WORKDIR /app
+COPY --from=build /wheels /wheels
+RUN pip install --no-cache-dir --no-index --find-links=/wheels /wheels/*.whl && rm -rf /wheels
 COPY . .
 EXPOSE 7799
 # 2 workers is plenty: chart computation is a few ms; timezonefinder/geonames load per worker
diff --git a/README.md b/README.md
index 3d1f2fc..0943eef 100644
--- a/README.md
+++ b/README.md
@@ -50,3 +50,18 @@ Open http://localhost:7799.
 
 Ephemeris data files are from the official Swiss Ephemeris distribution (AGPL,
 astro.com / github.com/aloistr/swisseph).
+
+## Live deployment
+
+Hosted at **https://stars.monsterrobot.games** — botchat/games VPS (`humanjing@100.71.119.27`),
+container `nategodd` (gunicorn, bound to 127.0.0.1:7799), fronted by the existing cloudflared
+tunnel (`~/.cloudflared/config.yml` ingress rule → `localhost:7799`; DNS = proxied CNAME to the
+tunnel). Stateless: no DB, no per-user storage — saved charts live in each visitor's browser.
+
+Redeploy after changes:
+
+```bash
+rsync -a --delete --exclude .venv --exclude .git --exclude __pycache__ ./ humanjing@100.71.119.27:nategodd/
+ssh humanjing@100.71.119.27 'cd ~/nategodd && docker compose up -d --build'
+curl -s -o /dev/null -w '%{http_code}\n' "https://stars.monsterrobot.games/?v=$(date +%s)"
+```