diff --git a/VNCMAIL-SETUP.md b/VNCMAIL-SETUP.md
index 0c5407fb..c12381ee 100644
--- a/VNCMAIL-SETUP.md
+++ b/VNCMAIL-SETUP.md
@@ -25,9 +25,9 @@ of truth; VNCmail+ is the UI. This repo deploys to **Vercel** as project
 
 | Branch | Role |
 |--------|------|
-| `main` | Tracks upstream Bulwark releases; kept as clean as possible |
-| `dev`  | VNC integration + **Vercel production branch (for now)** |
-| `vnc/*`| Feature branches for UI work |
+| `main` | **Production** — Vercel production branch. Only updated by an explicit promote. |
+| `dev`  | Integration + QA — every push auto-deploys a Vercel **preview**. Default working branch. |
+| `vnc/*`| Feature branches for UI work (branch off `dev`, PR into `dev`). |
 
 All VNC customization lives under `vnc/` (see `vnc/VNC-CHANGES.md`).
 
@@ -35,8 +35,8 @@ All VNC customization lives under `vnc/` (see `vnc/VNC-CHANGES.md`).
 
 1. **New Project** → import `brvncde-dotcom/vncmail-plus`.
 2. Project name: **`vncmail-plus`** (display "VNCmail+"). Framework: Next.js (auto).
-3. **Settings → Git → Production Branch = `dev`** (move to `main` only when you
-   cut a real prod domain).
+3. **Settings → Git → Production Branch = `main`** (Vercel's default for this repo).
+   `dev` and `vnc/*` pushes deploy as previews.
 4. **Settings → Environment Variables:** paste from `vnc/vercel.env.template`.
    - Generate the secret: `openssl rand -base64 32`
    - Mark `SESSION_SECRET` as **Sensitive**.
@@ -49,13 +49,27 @@ Add a subdomain of the Stalwart parent, e.g. `mail.sandbox.vnc.de` or
 `vncmailplus.sandbox.vnc.de`, in Vercel → Domains. Same parent domain keeps
 everything tidy and avoids any future cross-origin edge cases.
 
-## Syncing upstream later
+## Deploy workflow (dev-first — ALWAYS)
+
+Same flow as every other VNC/SRC repo:
+
+1. Work on `dev` (or `vnc/*` → PR into `dev`). Every push to `dev` auto-deploys a **preview**. QA there.
+2. **Promote to production only on explicit go-live** — merge `dev` → `main`:
+   ```bash
+   git log dev..main            # MUST be empty — main must have nothing dev lacks (else prod would revert)
+   git checkout main && git merge --ff-only dev
+   git push origin main         # Vercel deploys main → production
+   git checkout dev
+   ```
+   Never push straight to `main`. Never let a dev→main merge silently revert prod.
+
+## Syncing upstream (Bulwark releases)
+
+Bring upstream into `dev` (NOT main), integrate on a preview, then promote as above:
 
 ```bash
 git fetch upstream
-git checkout main && git merge upstream/main   # bring in new Bulwark release
-git checkout dev  && git merge main            # integrate; resolve via vnc/VNC-CHANGES.md
-git push origin main dev                        # Vercel redeploys dev
+git checkout dev && git merge upstream/main    # resolve conflicts via vnc/VNC-CHANGES.md; QA on preview
 ```
 
 ## Auth