diff --git a/reference/website.md b/reference/website.md
index ea7cef2..18f4df6 100644
--- a/reference/website.md
+++ b/reference/website.md
@@ -1,60 +1,51 @@
# Lodge website
-Static site `www.thelonglakelodge.com` (apex → 301 → www). Source at
-`git@code.fritzlab.net:websites/thelonglakelodge.com.git`. Published via
-`action/site-publish@v1`: push to `main` → `aws s3 sync --delete` to Garage
-bucket `thelonglakelodge.com`, ArgoCD reconciles Traefik Ingress + cert.
+Static site at `thelonglakelodge.com` (+ `www`, a CNAME to the apex). Hosted
+by Latchkey's managed-website service ("Websites" in the app): the files
+live in the `latchkey-sites` Garage bucket under the `thelonglakelodge.com/`
+key prefix, and the Latchkey `sites` edge serves them over its anycast IPs
+with automatic Let's Encrypt TLS. No Traefik, no per-site bucket Ingress.
+Registered in `custom_domains` (org "Fritz Family", id `cd-tll0001`).
+
+## Update the site
+
+In the Latchkey app: **Websites → thelonglakelodge.com → Manage files** —
+upload (replaces by path), list, delete. Files publish immediately. The
+old git repo `~/code/git/code.fritzlab.net/websites/thelonglakelodge.com`
++ `action/site-publish` flow is retired; edits go through the app now (or
+the API: `POST /v1/custom-domains/cd-tll0001/files`).
+
+DNS: apex A/AAAA → the sites anycast set (142.202.202.22 / .203.22 /
+23.145.176.22 + 2602:817:3000:ed6e::{202,203,176}:22); `www` CNAMEs the
+apex. Managed in `dns/authoritative/zone-templates/thelonglakelodge.com.j2`.
+
## Welcome packet PDF (`/welcome`)
-`https://www.thelonglakelodge.com/welcome` is a real HTTP 301 redirect to
-`/welcome.pdf` (browser renders the PDF in its native viewer). Unlisted, not
-in nav.
+`/welcome` and `/welcome.pdf` both serve the guest packet. The `/welcome`
+shortcut is the empty stub object carrying `x-amz-website-redirect-location:
+/welcome.pdf`; the managed-sites server follows that metadata internally
+(one hop) and streams the PDF — no browser-visible redirect.
-Both objects live in the Garage S3 bucket only, NOT in git:
-- `s3://thelonglakelodge.com/welcome` — empty object with
- `x-amz-website-redirect-location: /welcome.pdf` and `content-type: text/html`
-- `s3://thelonglakelodge.com/welcome.pdf` — the PDF itself
-
-Preserved across site-publish runs via `excludes: [welcome, welcome.pdf]` in
-`site.yaml` (the `--exclude` flag was added to `action/site-publish` for this
-case).
-
-### Update the packet
-
-One command — change is live immediately, no git/CI involved:
+Update the PDF by re-uploading `welcome.pdf` via Websites → Manage files
+(or `POST /v1/custom-domains/cd-tll0001/files`). To recreate the `/welcome`
+stub if lost:
```sh
-aws --profile sjc001 s3 cp /path/to/new.pdf \
- s3://thelonglakelodge.com/welcome.pdf \
- --content-type application/pdf
+aws --profile sjc001 s3api put-object --bucket latchkey-sites \
+ --key thelonglakelodge.com/welcome --content-type text/html \
+ --website-redirect-location /welcome.pdf --body /dev/null
```
-
-### Recreate the /welcome redirect (rarely needed)
-
-```sh
-aws --profile sjc001 s3api put-object \
- --bucket thelonglakelodge.com \
- --key welcome \
- --website-redirect-location /welcome.pdf \
- --content-type text/html
-```
-
-The `sjc001` aws-cli profile is documented in fritzlab `garage.md`.
## Guest-facing policy lives in two places
Check-out time, quiet hours, occupancy, and local-contact details are stated
-both in the welcome PDF and in the quick-ref cards on `site/house-rules.html`.
+both in the welcome PDF and in the quick-ref cards on `house-rules.html`.
When updating any of these values, update BOTH or they will drift.
-
-`house-rules.html` no longer contains the full rules accordion; it links to
-`/welcome` for the canonical detailed rules. The quick-ref cards remain on the
-page as an at-a-glance summary.