diff --git a/.github/workflows/live-zed-cloudflare.yml b/.github/workflows/live-zed-cloudflare.yml
new file mode 100644
index 0000000..511042f
--- /dev/null
+++ b/.github/workflows/live-zed-cloudflare.yml
@@ -0,0 +1,144 @@
+name: Live Zed GitHub and Cloudflare E2E
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/live-zed-cloudflare.yml"
+      - ".zpkg.toml"
+      - "src/payload.txt"
+      - "README.md"
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/live-zed-cloudflare.yml"
+      - ".zpkg.toml"
+      - "src/payload.txt"
+      - "README.md"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  packages: write
+
+concurrency:
+  group: live-zed-cloudflare-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: false
+
+defaults:
+  run:
+    shell: bash
+
+env:
+  CARGO_TERM_COLOR: always
+  RUST_BACKTRACE: "1"
+  ZED_CLI_SHA: 5c65985274dd42b5974db51c73adc256cb28bbdb
+  ZED_E2E_SHA: cb45233fea9b09b33295e410ec2a038f57e2dc5f
+
+jobs:
+  edge-probe:
+    name: Diagnose current registry edge
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - name: Print the public version response without credentials
+        run: |
+          set -euo pipefail
+          python3 - <<'PY'
+          import json
+          import urllib.error
+          import urllib.request
+
+          url = "https://registry.zpkg.net/v1/packages/zed-pkg-test/github-api-fallback-canary/versions/0.0.2"
+          request = urllib.request.Request(
+              url,
+              headers={"Accept": "application/json", "User-Agent": "zed-edge-probe/1.0"},
+          )
+          try:
+              response = urllib.request.urlopen(request, timeout=20)
+          except urllib.error.HTTPError as error:
+              response = error
+          body = response.read(4096).decode("utf-8", errors="replace")
+          headers = {
+              key.lower(): value
+              for key, value in response.headers.items()
+              if key.lower() in {
+                  "content-type",
+                  "retry-after",
+                  "server",
+                  "x-zed-edge",
+                  "x-zed-source",
+                  "cf-ray",
+              }
+          }
+          print(json.dumps({"status": response.status, "headers": headers, "body": body}, indent=2))
+          if response.status != 200:
+              raise SystemExit(f"registry edge returned HTTP {response.status}")
+          PY
+
+  live-round-trip:
+    name: Publish, proxy, install, freeze
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    steps:
+      - name: Check out isolated canary package
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          path: canary
+          fetch-depth: 1
+          persist-credentials: false
+          show-progress: false
+
+      - name: Check out exact merged zed-cli
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: zed-pkg/zed-cli
+          ref: ${{ env.ZED_CLI_SHA }}
+          path: product/zed-cli
+          fetch-depth: 1
+          persist-credentials: false
+          show-progress: false
+
+      - name: Check out exact merged E2E harness
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: zed-pkg-test/zed-pkg-e2e
+          ref: ${{ env.ZED_E2E_SHA }}
+          path: product/zed-pkg-e2e
+          fetch-depth: 1
+          persist-credentials: false
+          show-progress: false
+
+      - name: Verify immutable merged inputs
+        run: |
+          set -euo pipefail
+          test "$(git -C product/zed-cli rev-parse HEAD)" = "$ZED_CLI_SHA"
+          test "$(git -C product/zed-pkg-e2e rev-parse HEAD)" = "$ZED_E2E_SHA"
+          test ! -e canary/product
+          python3 -m py_compile product/zed-pkg-e2e/scripts/zed_github_cloudflare_e2e.py
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30
+        with:
+          toolchain: stable
+
+      - name: Build exact merged zed
+        run: |
+          set -euo pipefail
+          cargo build \
+            --locked \
+            --release \
+            --manifest-path product/zed-cli/Cargo.toml \
+            --bin zed
+
+      - name: Exercise GitHub writes, Cloudflare reads, and direct GitHub installs
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          python3 product/zed-pkg-e2e/scripts/zed_github_cloudflare_e2e.py \
+            --zed "$GITHUB_WORKSPACE/product/zed-cli/target/release/zed" \
+            --package-root "$GITHUB_WORKSPACE/canary" \
+            --work-root "$RUNNER_TEMP/live-zed-cloudflare" \
+            --version 0.0.6
diff --git a/.zpkg.toml b/.zpkg.toml
index ce6eea4..90e1236 100644
--- a/.zpkg.toml
+++ b/.zpkg.toml
@@ -1,8 +1,8 @@
 [package]
 org = "zed-pkg-test"
 name = "github-api-fallback-canary"
-version = "0.0.1"
-description = "Live GitHub API fallback canary"
+version = "0.0.6"
+description = "Live zed publish/install canary for GitHub and Cloudflare fallback"
 license = "MIT"
 
 [package.repository]
diff --git a/README.md b/README.md
index 90c4e1b..331d542 100644
--- a/README.md
+++ b/README.md
@@ -1,2 +1,19 @@
 # github-api-fallback-canary
-Live GitHub API canary: packed Zed artifact on Releases so registry.zpkg.net outages still install.
+
+Public, non-secret package used to verify Zed's production fallback chain.
+
+The `Live Zed GitHub and Cloudflare E2E` workflow builds exact commits of
+`zed-pkg/zed-cli` and `zed-pkg-test/zed-pkg-e2e`, then:
+
+1. runs the real `zed publish` command with the registry intentionally
+   unreachable;
+2. requires the package artifact and metadata sidecar to be hosted on this
+   repository's GitHub Release;
+3. compares direct GitHub bytes with the `cdn.zpkg.net/github/...` proxy;
+4. verifies `registry.zpkg.net` reconstructs version metadata from the public
+   sidecar; and
+5. runs normal and frozen installs with registry and R2 access disabled so the
+   CLI must consume the GitHub Release directly.
+
+Everything in this repository and its Releases is public. Never add credentials,
+private source, customer data, or user data to the canary payload.
diff --git a/src/payload.txt b/src/payload.txt
new file mode 100644
index 0000000..adfce09
--- /dev/null
+++ b/src/payload.txt
@@ -0,0 +1 @@
+real-zed-github-cloudflare-e2e-v0.0.6