diff --git a/webfs.go b/webfs.go
new file mode 100644
index 0000000..bf537ce
--- /dev/null
+++ b/webfs.go
@@ -0,0 +1,32 @@
+package main
+
+import (
+	"embed"
+	"io/fs"
+	"net/http"
+	"path"
+	"strings"
+)
+
+// The built frontend is compiled into the binary, so deployment is one file.
+//
+//go:embed all:web/dist
+var webFS embed.FS
+
+func webHandler() http.Handler {
+	dist, err := fs.Sub(webFS, "web/dist")
+	if err != nil {
+		panic(err)
+	}
+	fileServer := http.FileServer(http.FS(dist))
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		p := strings.TrimPrefix(path.Clean(r.URL.Path), "/")
+		if p != "" {
+			if _, err := fs.Stat(dist, p); err != nil {
+				// SPA fallback: unknown paths serve the app shell.
+				r.URL.Path = "/"
+			}
+		}
+		fileServer.ServeHTTP(w, r)
+	})
+}