diff --git a/infra/main.tf b/infra/main.tf
index 7fd80c4..eec7461 100644
--- a/infra/main.tf
+++ b/infra/main.tf
@@ -152,16 +152,38 @@ locals {
   )
 }
 
-resource "cloudflare_worker" "demo" {
-  for_each   = local.demo_workers
-  account_id = var.account_id
-  name       = each.value
+# Created through the scripts API, like the router, with a placeholder that
+# answers 503 until the Deploy Examples workflow uploads the real code. After
+# that the workflow owns the code and settings, so Terraform never updates
+# them. A code-less cloudflare_worker can't take routes ("Cannot configure a
+# route for a Worker which does not exist"), so the placeholder is what lets
+# the routes apply before the first deploy.
+resource "cloudflare_workers_script" "demo" {
+  for_each           = local.demo_workers
+  account_id         = var.account_id
+  script_name        = each.value
+  main_module        = "placeholder.js"
+  compatibility_date = "2026-09-01"
+  content            = <<-JS
+    export default {
+      fetch() {
+        return new Response("This demo hasn't been deployed yet.", { status: 503 });
+      },
+    };
+  JS
+
+  lifecycle {
+    ignore_changes = all
+  }
+}
+
+# The first apply created these as code-less cloudflare_worker resources.
+# Forget them without deleting; the scripts above upload to the same names.
+removed {
+  from = cloudflare_worker.demo
 
-  # Only reachable through the routes below, like workers_dev = false and
-  # preview_urls = false in each wrangler.toml.
-  subdomain = {
-    enabled          = false
-    previews_enabled = false
+  lifecycle {
+    destroy = false
   }
 }
 
@@ -171,7 +193,7 @@ resource "cloudflare_workers_route" "demo" {
   for_each = local.demo_routes
   zone_id  = var.zone_id
   pattern  = each.value.pattern
-  script   = cloudflare_worker.demo[each.value.worker].name
+  script   = cloudflare_workers_script.demo[each.value.worker].script_name
 }
 
 # --- VS Code Marketplace Domain Verification ---