diff --git a/.gitignore b/.gitignore
index 82ccf33..ea28553 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,7 +5,5 @@ __pycache__/
 .claude/settings.local.json
 .DS_Store
 site/dist/
-# fetched per checkout by site/fetch-fonts.py, never committed
-site/static/fonts/*.woff2
 # wrangler's local cache, written by a deploy from this checkout
 .wrangler/
diff --git a/site/README.md b/site/README.md
index a8c8d4f..2f44ddc 100644
--- a/site/README.md
+++ b/site/README.md
@@ -27,11 +27,13 @@ prose into this directory.
 
 ```bash
 python3 -m pip install -r site/requirements.txt   # once
-python3 site/fetch-fonts.py                       # once, needs network
 python3 site/build.py                             # → site/dist/
 ```
 
-`site/dist/` is gitignored — it is output, rebuilt on every deploy.
+`site/dist/` is gitignored — it is output, rebuilt on every deploy. The
+woff2 files under `static/fonts/` are not: they are committed, so a
+clean checkout builds the real typography without asking anyone for it,
+and a deploy is the same bytes from any machine.
 
 `site/` never reaches a host repo: releases ship exactly what
 `../manager/core/release-manifest` lists, and it does not list this
@@ -56,13 +58,12 @@ separate decision with a separate cost, and a follow-up card.
 
 ## Deploying
 
-From a clean checkout, four commands. Re-running the whole sequence is
+From a clean checkout, three commands. Re-running the whole sequence is
 safe: the build empties and rewrites `dist/`, and `wrangler deploy`
 replaces the Worker's assets rather than adding to them.
 
 ```bash
 python3 -m pip install -r site/requirements.txt   # once per machine
-python3 site/fetch-fonts.py                       # once per checkout
 python3 site/build.py                             # → site/dist/
 npx wrangler@4 deploy --config site/wrangler.jsonc
 ```
@@ -135,7 +136,7 @@ answers rather than files:
 | `root/` | Copied to the **top** of `dist/` verbatim: `_headers`, which the host reads and never serves |
 | `wrangler.jsonc` | The Worker: assets directory, url handling, 404, custom domain |
 | `requirements.txt` | `markdown-it-py`, pinned. The only dependency |
-| `fetch-fonts.py` | Downloads the self-hosted woff2 files, once |
+| `fetch-fonts.py` | Refetches the committed woff2 files, or adds a face |
 
 ## A manifest entry
 
diff --git a/site/static/fonts/IBMPlexMono-Medium.woff2 b/site/static/fonts/IBMPlexMono-Medium.woff2
new file mode 100644
index 0000000..3308bce
Binary files /dev/null and b/site/static/fonts/IBMPlexMono-Medium.woff2 differ
diff --git a/site/static/fonts/IBMPlexMono-Regular.woff2 b/site/static/fonts/IBMPlexMono-Regular.woff2
new file mode 100644
index 0000000..52b6c75
Binary files /dev/null and b/site/static/fonts/IBMPlexMono-Regular.woff2 differ
diff --git a/site/static/fonts/IBMPlexSans-Italic.woff2 b/site/static/fonts/IBMPlexSans-Italic.woff2
new file mode 100644
index 0000000..9426b4b
Binary files /dev/null and b/site/static/fonts/IBMPlexSans-Italic.woff2 differ
diff --git a/site/static/fonts/IBMPlexSans-Medium.woff2 b/site/static/fonts/IBMPlexSans-Medium.woff2
new file mode 100644
index 0000000..feb1cdf
Binary files /dev/null and b/site/static/fonts/IBMPlexSans-Medium.woff2 differ
diff --git a/site/static/fonts/IBMPlexSans-Regular.woff2 b/site/static/fonts/IBMPlexSans-Regular.woff2
new file mode 100644
index 0000000..ee30928
Binary files /dev/null and b/site/static/fonts/IBMPlexSans-Regular.woff2 differ
diff --git a/site/static/fonts/IBMPlexSans-SemiBold.woff2 b/site/static/fonts/IBMPlexSans-SemiBold.woff2
new file mode 100644
index 0000000..ef2cb45
Binary files /dev/null and b/site/static/fonts/IBMPlexSans-SemiBold.woff2 differ
diff --git a/site/static/fonts/README.md b/site/static/fonts/README.md
index 5ce4bf4..7e1f818 100644
--- a/site/static/fonts/README.md
+++ b/site/static/fonts/README.md
@@ -18,16 +18,22 @@ in `site.css` ask for:
 | `IBMPlexMono-Medium.woff2` | IBM Plex Mono | 500 | normal |
 | `ZillaSlab-SemiBold.woff2` | Zilla Slab | 600 | normal |
 
-## Fetching them
+## Where they come from
+
+The seven files are **committed**, so a clean checkout builds the real
+typography with no network and a deploy is the same bytes from any
+machine. Run the script only to refresh them or to add a face:
 
 ```bash
 python3 site/fetch-fonts.py
 ```
 
-The script asks Google Fonts for the CSS these faces would need, reads
-the `woff2` URLs out of the reply, and writes the files here under the
-names above. What it downloads is already the `latin` subset Google
-serves — the site's copy of the font, not a link to Google's.
+It asks Google Fonts for the CSS these faces would need, reads the
+`woff2` URLs out of the reply, and writes the files here under the names
+above. What it downloads is already the `latin` subset Google serves —
+the site's copy of the font, not a link to Google's. That request
+happens once, on the machine that refreshes a face; nothing the site
+serves ever makes it.
 
 Both families are licensed for this: IBM Plex under the SIL Open Font
 License 1.1, Zilla Slab likewise. Keeping the downloaded `*.LICENSE.txt`
diff --git a/site/static/fonts/ZillaSlab-SemiBold.woff2 b/site/static/fonts/ZillaSlab-SemiBold.woff2
new file mode 100644
index 0000000..e82c137
Binary files /dev/null and b/site/static/fonts/ZillaSlab-SemiBold.woff2 differ