diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index f987a98..e211738 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -63,6 +63,10 @@ jobs:
         uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: ./dist
+          # Without this the action tars ./dist with --exclude=.[^/]*, which drops
+          # public/.well-known/ - the domain verification files served from there
+          # (Flathub, security.txt) would 404 in production.
+          include-hidden-files: true
 
   deploy:
     environment:
diff --git a/public/.well-known/org.flathub.VerifiedApps.txt b/public/.well-known/org.flathub.VerifiedApps.txt
new file mode 100644
index 0000000..f01d279
--- /dev/null
+++ b/public/.well-known/org.flathub.VerifiedApps.txt
@@ -0,0 +1,2 @@
+# Flathub website verification: https://docs.flathub.org/docs/for-app-authors/verification
+# App tokens are appended below once Flathub issues them, one per line.