diff --git a/.envrc.example b/.envrc.example
new file mode 100644
index 0000000..3550a30
--- /dev/null
+++ b/.envrc.example
@@ -0,0 +1 @@
+use flake
diff --git a/.firebaserc b/.firebaserc
new file mode 100644
index 0000000..9a2f41d
--- /dev/null
+++ b/.firebaserc
@@ -0,0 +1,5 @@
+{
+  "projects": {
+    "default": "penumbra-uips"
+  }
+}
diff --git a/.github/workflows/firebase-hosting-merge.yml b/.github/workflows/firebase-hosting-merge.yml
new file mode 100644
index 0000000..21886fd
--- /dev/null
+++ b/.github/workflows/firebase-hosting-merge.yml
@@ -0,0 +1,28 @@
+# This file was auto-generated by the Firebase CLI
+# https://github.com/firebase/firebase-tools
+
+name: Deploy to Firebase Hosting on merge
+on:
+  push:
+    branches:
+      - main
+jobs:
+  build_and_deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: install nix
+        uses: DeterminateSystems/nix-installer-action@main
+      - name: load nix cache
+        uses: DeterminateSystems/magic-nix-cache-action@main
+
+      - name: build static docroot
+        run: nix develop --command just build
+
+      - uses: FirebaseExtended/action-hosting-deploy@v0
+        with:
+          repoToken: ${{ secrets.GITHUB_TOKEN }}
+          firebaseServiceAccount: ${{ secrets.FIREBASE_SERVICE_ACCOUNT_PENUMBRA_UIPS }}
+          channelId: live
+          projectId: penumbra-uips
diff --git a/.github/workflows/firebase-hosting-pull-request.yml b/.github/workflows/firebase-hosting-pull-request.yml
new file mode 100644
index 0000000..d2fa021
--- /dev/null
+++ b/.github/workflows/firebase-hosting-pull-request.yml
@@ -0,0 +1,29 @@
+# This file was auto-generated by the Firebase CLI
+# https://github.com/firebase/firebase-tools
+
+name: Deploy to Firebase Hosting on PR
+on: pull_request
+permissions:
+  checks: write
+  contents: read
+  pull-requests: write
+jobs:
+  build_and_preview:
+    if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: install nix
+        uses: DeterminateSystems/nix-installer-action@main
+      - name: load nix cache
+        uses: DeterminateSystems/magic-nix-cache-action@main
+
+      - name: build static docroot
+        run: nix develop --command just build
+
+      - uses: FirebaseExtended/action-hosting-deploy@v0
+        with:
+          repoToken: ${{ secrets.GITHUB_TOKEN }}
+          firebaseServiceAccount: ${{ secrets.FIREBASE_SERVICE_ACCOUNT_PENUMBRA_UIPS }}
+          projectId: penumbra-uips
diff --git a/.gitignore b/.gitignore
index d3af563..b1e4b2c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,4 +5,11 @@ index.html
 cips/*.html
 
 # WGs - same note as above
-cips/wgs/**/*.html
\ No newline at end of file
+cips/wgs/**/*.html
+
+# ignore direnv; run `cp .envrc.example .envrc` to bootstrap dev tooling
+.envrc
+.direnv/
+
+# firebase for static website hosting
+.firebase/
diff --git a/firebase.json b/firebase.json
new file mode 100644
index 0000000..3f5cdf6
--- /dev/null
+++ b/firebase.json
@@ -0,0 +1,10 @@
+{
+  "hosting": {
+    "public": "book",
+    "ignore": [
+      "firebase.json",
+      "**/.*",
+      "**/node_modules/**"
+    ]
+  }
+}
diff --git a/flake.lock b/flake.lock
new file mode 100644
index 0000000..208b760
--- /dev/null
+++ b/flake.lock
@@ -0,0 +1,61 @@
+{
+  "nodes": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1726560853,
+        "narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "c1dfcf08411b08f6b8615f7d8971a2bfa81d5e8a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1731239293,
+        "narHash": "sha256-q2yjIWFFcTzp5REWQUOU9L6kHdCDmFDpqeix86SOvDc=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "9256f7c71a195ebe7a218043d9f93390d49e6884",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-24.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 0000000..99307d2
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,28 @@
+# in flake.nix
+{
+  inputs = {
+    # nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.05";
+    flake-utils.url = "github:numtide/flake-utils";
+  };
+  outputs = { self, nixpkgs, flake-utils }:
+    flake-utils.lib.eachDefaultSystem
+      (system:
+        let
+          pkgs = import nixpkgs {
+            inherit system ;
+          };
+        in
+        with pkgs;
+        {
+          devShells.default = mkShell {
+            buildInputs = [ 
+                firebase-tools
+                just
+                markdownlint-cli
+                mdbook
+            ];
+          };
+        }
+      );
+}
diff --git a/justfile b/justfile
new file mode 100644
index 0000000..056d5c4
--- /dev/null
+++ b/justfile
@@ -0,0 +1,20 @@
+# display this help menu
+list:
+    @just --list
+
+# build static site
+build:
+    mdbook build
+
+# run code linters to check formatting
+lint:
+    markdownlint --config .markdownlint.yaml '**/*.md'
+
+# run dev env with livereload, for local editing
+dev:
+    mdbook serve -n 127.0.0.1
+
+# run dev env via firebase, for a more prod-like local editing experience
+firebase-dev:
+    @just build
+    firebase emulators:start