diff --git a/.gitignore b/.gitignore
index 30dd112..15c9b73 100644
--- a/.gitignore
+++ b/.gitignore
@@ -65,6 +65,10 @@ levineuwirth_handover.zip
 # Download with: make download-model
 static/models/
 
+# Vendored PDF.js viewer (~18 MB uncompressed, pinned in tools/download-pdfjs.sh).
+# Download with: make download-pdfjs
+static/pdfjs/
+
 # Generated WebP companions (produced by tools/convert-images.sh at build time).
 # To intentionally commit a WebP, use: git add -f path/to/file.webp
 static/**/*.webp
diff --git a/Makefile b/Makefile
index da38bb7..a067f48 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: build deploy sign download-model convert-images pdf-thumbs pdfs watch clean dev
+.PHONY: build deploy sign download-model download-pdfjs convert-images pdf-thumbs pdfs watch clean dev
 
 # Source .env for GITHUB_TOKEN and GITHUB_REPO if it exists.
 # .env format: KEY=value (one per line, no `export` prefix, no quotes needed).
@@ -17,6 +17,7 @@ build:
 	@date +%s > data/build-start.txt
 	@./tools/convert-images.sh
 	@$(MAKE) -s pdf-thumbs
+	@./tools/download-pdfjs.sh
 	cabal run site -- build
 	pagefind --site _site
 	@if [ -d .venv ]; then \
@@ -37,6 +38,12 @@ sign:
 download-model:
 	@./tools/download-model.sh
 
+# Vendor Mozilla's prebuilt PDF.js viewer into static/pdfjs/.
+# Runs automatically as part of `build` (skips when already present).
+# Files are gitignored; sha256-verified against tools/pdfjs-checksums.sha256.
+download-pdfjs:
+	@./tools/download-pdfjs.sh
+
 # Convert JPEG/PNG images to WebP companions (also runs automatically in build).
 # Requires cwebp: pacman -S libwebp  /  apt install webp
 convert-images:
diff --git a/static/cv.pdf b/static/cv.pdf
index 926aa28..ac15a31 100644
Binary files a/static/cv.pdf and b/static/cv.pdf differ
diff --git a/static/resume.pdf b/static/resume.pdf
index b6f5872..c203a6a 100644
Binary files a/static/resume.pdf and b/static/resume.pdf differ
diff --git a/tools/download-pdfjs.sh b/tools/download-pdfjs.sh
new file mode 100755
index 0000000..03e1d33
--- /dev/null
+++ b/tools/download-pdfjs.sh
@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# download-pdfjs.sh — Vendor Mozilla's prebuilt PDF.js viewer into static/pdfjs/.
+#
+# The Haskell link filter (build/Filters/Links.hs) rewrites every root-relative
+# .pdf link to open through /pdfjs/web/viewer.html, so this viewer must be
+# present in static/ for the site build to produce working PDF links.
+#
+# Run once before deploying. The extracted viewer is gitignored (~18 MB
+# uncompressed); re-running is safe — the script skips when the viewer
+# already exists.
+#
+# To bump the pinned version, set PDFJS_VERSION, re-run, then update
+# tools/pdfjs-checksums.sha256 with the new archive SHA-256.
+
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+PDFJS_DIR="$REPO_ROOT/static/pdfjs"
+CHECKSUMS="$REPO_ROOT/tools/pdfjs-checksums.sha256"
+
+PDFJS_VERSION="${PDFJS_VERSION:-5.6.205}"
+ARCHIVE="pdfjs-${PDFJS_VERSION}-dist.zip"
+URL="https://github.com/mozilla/pdf.js/releases/download/v${PDFJS_VERSION}/${ARCHIVE}"
+
+if [ -f "$PDFJS_DIR/web/viewer.html" ]; then
+    echo "pdfjs: already present at $PDFJS_DIR/web/viewer.html (skipping)"
+    exit 0
+fi
+
+command -v unzip >/dev/null 2>&1 || {
+    echo "download-pdfjs: unzip not found — install it (pacman -S unzip / apt install unzip)" >&2
+    exit 1
+}
+
+tmpdir=$(mktemp -d)
+trap 'rm -rf "$tmpdir"' EXIT
+
+echo "pdfjs: downloading $ARCHIVE"
+curl -fsSL --progress-bar "$URL" -o "$tmpdir/$ARCHIVE"
+
+if [ -f "$CHECKSUMS" ]; then
+    want=$(awk -v p="$ARCHIVE" '$2 == p { print $1; exit }' "$CHECKSUMS")
+    if [ -n "$want" ]; then
+        got=$(sha256sum "$tmpdir/$ARCHIVE" | awk '{ print $1 }')
+        if [ "$got" != "$want" ]; then
+            echo "pdfjs: sha256 mismatch for $ARCHIVE" >&2
+            echo "       expected $want" >&2
+            echo "       got      $got" >&2
+            exit 1
+        fi
+        echo "pdfjs: sha256 verified"
+    else
+        echo "pdfjs: no pinned checksum for $ARCHIVE in $CHECKSUMS — skipping verification" >&2
+    fi
+else
+    echo "pdfjs: $CHECKSUMS not found — skipping sha256 verification" >&2
+fi
+
+mkdir -p "$PDFJS_DIR"
+echo "pdfjs: extracting to $PDFJS_DIR"
+unzip -q -o "$tmpdir/$ARCHIVE" -d "$PDFJS_DIR"
+
+echo "pdfjs: done. static/pdfjs/web/viewer.html is ready."
+echo "       Run 'make build' to include it in _site/."
diff --git a/tools/pdfjs-checksums.sha256 b/tools/pdfjs-checksums.sha256
new file mode 100644
index 0000000..7472380
--- /dev/null
+++ b/tools/pdfjs-checksums.sha256
@@ -0,0 +1 @@
+0555ef47464e456125dcd0b9742cfa2aaed6d282e804e4dd1f1b99316b46ac00  pdfjs-5.6.205-dist.zip