diff --git a/.github/workflows/README.md b/.github/workflows/README.md
new file mode 100644
index 000000000..f907f3407
--- /dev/null
+++ b/.github/workflows/README.md
@@ -0,0 +1,51 @@
+# GitHub Actions Workflows
+
+## Update Demo Server
+
+**File**: `update-demo-server.yml`
+
+Automatically updates the public demo server (`pulse-relay`) when a new stable release is published.
+
+### Configuration Required
+
+Add these secrets to your GitHub repository settings (`Settings` → `Secrets and variables` → `Actions`):
+
+1. **DEMO_SERVER_SSH_KEY**
+   - The private SSH key for accessing the demo server
+   - Generate with: `cat ~/.ssh/id_ed25519` (or your key file)
+   - Should be the full private key including `-----BEGIN` and `-----END` lines
+
+2. **DEMO_SERVER_HOST**
+   - The hostname or IP of the demo server
+   - Value: `174.138.72.137` (or hostname if using DNS)
+
+3. **DEMO_SERVER_USER**
+   - The SSH username for the demo server
+   - Value: `root` (or the appropriate user with sudo access)
+
+### How It Works
+
+1. **Trigger**: Runs automatically when a GitHub release is published
+2. **Filter**: Only runs for stable releases (skips RC/pre-releases)
+3. **Update**: SSHs to demo server and runs the install script
+4. **Verify**: Checks that the new version is running and mock mode is active
+5. **Cleanup**: Removes SSH key from runner
+
+### Testing
+
+To test without publishing a release:
+1. Go to `Actions` tab in GitHub
+2. Select `Update Demo Server` workflow
+3. Click `Run workflow` (if manual trigger is enabled)
+
+Or test manually:
+```bash
+ssh pulse-relay "curl -fsSL https://raw.githubusercontent.com/rcourtman/Pulse/main/install.sh | sudo bash"
+```
+
+### Benefits
+
+- ✅ Demo server always showcases latest stable release
+- ✅ Validates install script works on real server
+- ✅ Removes manual step from release process
+- ✅ Free to run (public repos get unlimited GitHub Actions minutes)
diff --git a/.github/workflows/update-demo-server.yml b/.github/workflows/update-demo-server.yml
new file mode 100644
index 000000000..f5591c4f9
--- /dev/null
+++ b/.github/workflows/update-demo-server.yml
@@ -0,0 +1,58 @@
+name: Update Demo Server
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  update-demo:
+    # Only run for stable releases (not pre-releases)
+    if: github.event.release.prerelease == false
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check release type
+        run: |
+          echo "Release: ${{ github.event.release.tag_name }}"
+          echo "Prerelease: ${{ github.event.release.prerelease }}"
+          echo "Updating demo server to latest stable release..."
+
+      - name: Setup SSH
+        run: |
+          mkdir -p ~/.ssh
+          echo "${{ secrets.DEMO_SERVER_SSH_KEY }}" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          ssh-keyscan -H ${{ secrets.DEMO_SERVER_HOST }} >> ~/.ssh/known_hosts
+
+      - name: Update demo server
+        run: |
+          ssh -i ~/.ssh/id_ed25519 ${{ secrets.DEMO_SERVER_USER }}@${{ secrets.DEMO_SERVER_HOST }} \
+            'curl -fsSL https://raw.githubusercontent.com/rcourtman/Pulse/main/install.sh | sudo bash'
+
+      - name: Verify update
+        run: |
+          # Wait a moment for service to restart
+          sleep 5
+
+          # Check version endpoint
+          VERSION=$(ssh -i ~/.ssh/id_ed25519 ${{ secrets.DEMO_SERVER_USER }}@${{ secrets.DEMO_SERVER_HOST }} \
+            "curl -s http://localhost:7655/api/version | grep -o '\"version\":\"[^\"]*' | cut -d'\"' -f4")
+
+          echo "Demo server is now running version: $VERSION"
+
+          # Verify mock mode is active
+          NODES=$(ssh -i ~/.ssh/id_ed25519 ${{ secrets.DEMO_SERVER_USER }}@${{ secrets.DEMO_SERVER_HOST }} \
+            "curl -s http://localhost:7655/api/state | grep -o '\"nodes\":\[[^]]*\]' | grep -o 'pve[0-9]' | wc -l")
+
+          echo "Mock nodes detected: $NODES"
+
+          if [ "$NODES" -ge 1 ]; then
+            echo "✅ Demo server successfully updated and verified!"
+          else
+            echo "⚠️  Demo server updated but mock mode may not be active"
+            exit 1
+          fi
+
+      - name: Cleanup SSH key
+        if: always()
+        run: rm -f ~/.ssh/id_ed25519