diff --git a/README.md b/README.md
index 44ba4e3..3e67e7d 100644
--- a/README.md
+++ b/README.md
@@ -30,7 +30,7 @@ Backfill stats (initial run): 14,825 POs scanned → 9,900 with extractable site
 
 ## Architecture
 
-- **IaC:** AWS CDK (Python), stack name `PoIngestStack`, region `us-east-1`.
+- **IaC:** AWS CDK (Python), stack name `po-ingest`, region `us-east-1`.
 - **Lambdas** (all Python 3.12, arm64, 60-day log retention):
   - `po-email-processor` — S3-triggered, parses PO emails via Claude Haiku.
   - `po-web-ui` — Function URL, HTML dashboard.
@@ -42,6 +42,13 @@ Backfill stats (initial run): 14,825 POs scanned → 9,900 with extractable site
   - DynamoDB `pending-site-review` — PK `po_number`. POs with no extractable site code and no address match, awaiting manual Payee Central verification.
 - **Secrets:** Anthropic API key in Secrets Manager at `po-ingest/anthropic-api-key`.
 - **SES:** adds the `PoEmailRule` to the existing `INBOUND_MAIL` receipt rule set (shared with `workorder-ingest`).
+- **CI/CD:** CodePipeline V2 (`po-ingest-pipeline`) → CodeBuild (`po-ingest-build`). Pushes to `main` auto-deploy via `buildspec.yml`.
+
+## CI/CD
+
+Merges to `main` trigger the `po-ingest-pipeline` (CodePipeline V2) which runs CodeBuild to `cdk deploy`. The pipeline uses the existing CodeStar connection to the Sea-Haven-Industries GitHub org.
+
+**Branch protection:** `main` requires a PR (no direct push), no deletion, no force push.
 
 ## Setup
 
diff --git a/buildspec.yml b/buildspec.yml
new file mode 100644
index 0000000..da69dde
--- /dev/null
+++ b/buildspec.yml
@@ -0,0 +1,15 @@
+version: 0.2
+
+phases:
+  install:
+    runtime-versions:
+      python: 3.12
+      nodejs: 22
+    commands:
+      - npm install -g aws-cdk
+      - pip install -r cdk/requirements.txt
+      - pip install -r lambdas/email_processor/requirements.txt -t lambdas/email_processor/package/
+      - cp lambdas/email_processor/handler.py lambdas/email_processor/package/
+  build:
+    commands:
+      - cd cdk && cdk deploy --require-approval never
diff --git a/cdk/app.py b/cdk/app.py
index a8ae9ba..1c5f42f 100644
--- a/cdk/app.py
+++ b/cdk/app.py
@@ -4,7 +4,7 @@ from stack import PoIngestStack
 
 app = cdk.App()
 PoIngestStack(app, "po-ingest",
-    stack_name="PoIngestStack",
+    stack_name="po-ingest",
     env=cdk.Environment(region="us-east-1"),
 )
 app.synth()
diff --git a/cdk/stack.py b/cdk/stack.py
index cdb0908..21ec4c5 100644
--- a/cdk/stack.py
+++ b/cdk/stack.py
@@ -53,6 +53,7 @@ class PoIngestStack(Stack):
             self, "AnthropicApiKey",
             secret_name="po-ingest/anthropic-api-key",
             description="Anthropic API key for Coupa PO email parsing",
+            removal_policy=RemovalPolicy.RETAIN,
         )
 
         # --- Lambda function ---