diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f64ea16..bd0f1aa 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -82,7 +82,7 @@ jobs:
       - name: Publish WASM to CDN
         run: >
           node scripts/deploy/publish-wasm.mjs --tag "${{ needs.meta.outputs.tag }}"
-          --src output --driver r2 --bucket "$BUCKET" --remote --compress gzip
+          --src output --driver r2 --bucket "$BUCKET" --remote --compress br --quality 11
 
   # 3) Build the standalone pinned to this tag's manifest + libs, deploy to Pages.
   deploy-demo:
diff --git a/scripts/deploy/lib/cdn-store.mjs b/scripts/deploy/lib/cdn-store.mjs
index 75b7057..bafb697 100644
--- a/scripts/deploy/lib/cdn-store.mjs
+++ b/scripts/deploy/lib/cdn-store.mjs
@@ -17,7 +17,10 @@ import { gzipSync, brotliCompressSync, constants as zc } from "node:zlib";
 import { tmpdir } from "node:os";
 import { join, dirname } from "node:path";
 
-export const IMMUTABLE = "public, max-age=31536000, immutable";
+// `no-transform` keeps Cloudflare's edge from decompressing our pre-compressed
+// (brotli-q11) blobs and re-serving them at its own on-the-fly quality (br-4);
+// also preserves the original Content-Length. Immutable content-addressed blobs.
+export const IMMUTABLE = "public, max-age=31536000, immutable, no-transform";
 export const NO_STORE = "no-store";
 
 export const sha256hex = (buf) => createHash("sha256").update(buf).digest("hex");