diff --git a/.github/workflows/deploy-pages.yml b/.github/workflows/deploy-pages.yml
index ea6897b..3c52684 100644
--- a/.github/workflows/deploy-pages.yml
+++ b/.github/workflows/deploy-pages.yml
@@ -3,6 +3,12 @@ name: deploy-pages
 on:
   push:
     branches: [main]
+  # Build on every pull request too, so a change to the layout, the content or
+  # the Hugo version has to prove the site still builds before it lands.
+  # Without this the workflow ran only on main, which meant a dependency bump
+  # arrived with no signal at all -- its checks read "no checks", which is not
+  # the same thing as green and must not be merged as if it were.
+  pull_request:
   workflow_dispatch:
 
 permissions:
@@ -40,6 +46,10 @@ jobs:
           path: public
 
   deploy:
+    # Only main publishes. A pull request stops after build above: it has built
+    # the site, which is the whole point of the gate, and it has no business
+    # replacing what is served.
+    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
     needs: build
     runs-on: ubuntu-latest
     environment: