diff --git a/.github/workflows/dependency-security.yml b/.github/workflows/dependency-security.yml
index fb99ca1b..9fba20b8 100644
--- a/.github/workflows/dependency-security.yml
+++ b/.github/workflows/dependency-security.yml
@@ -2,9 +2,15 @@ name: Dependency Security
 
 on:
   push:
+    # Only master, for the reason ci.yml gives: a branch worth auditing has a
+    # pull request, and that is what triggers below.
     branches: [master]
   pull_request:
-    branches: [master]
+    # Unfiltered by base branch, matching ci.yml. Filtering to `[master]` left
+    # a pull request stacked on another branch with no audit at all until its
+    # root merged -- and a PR with no audit still reports a green mergeable
+    # state, because nothing required failed. A dependency advisory is worth
+    # hearing about on the PR that introduces it, not several PRs later.
     types: [opened, reopened, synchronize, ready_for_review]
   workflow_dispatch:
 
diff --git a/docs/tally/compatibility/compatibility-matrix.json b/docs/tally/compatibility/compatibility-matrix.json
index 6ddba8ad..3273e529 100644
--- a/docs/tally/compatibility/compatibility-matrix.json
+++ b/docs/tally/compatibility/compatibility-matrix.json
@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "bridge_commit_sha": "be1c20cc3fd66fa1ece196505c69f26e555e4b8e",
-  "compatibility_surface_sha256": "b0a658a972bd150599add28b408fddf5026c3dc67a105e49f7256ca7ada255ad",
+  "compatibility_surface_sha256": "ad4e2866217ec8778d76a3eb50c951b892d47bd9f786f38cfd3bd1e07e72bd95",
   "claims": [
     {
       "claim_id": "erp9-6-6-3-windows-education-xml-one-company",
diff --git a/docs/tally/compatibility/compatibility-surface.json b/docs/tally/compatibility/compatibility-surface.json
index 078e04a0..037a1b20 100644
--- a/docs/tally/compatibility/compatibility-surface.json
+++ b/docs/tally/compatibility/compatibility-surface.json
@@ -7,7 +7,7 @@
     },
     {
       "path": ".github/workflows/dependency-security.yml",
-      "sha256": "3c014174f82b5935c97ae5d228f1c2ee71e03f00c327d667df1ca4ff27cf75f4"
+      "sha256": "fd70b9a317677100d6b760a369495f9e3c6a083d7cdbf8f1916267d97eaa250f"
     },
     {
       "path": "docs/adr/0004-tally-write-safety.md",
@@ -850,5 +850,5 @@
       "sha256": "a8ac2714fecf51947f2822c8c46d7ce2e8602c732780ff60566a7771f0836f9a"
     }
   ],
-  "manifest_sha256": "b0a658a972bd150599add28b408fddf5026c3dc67a105e49f7256ca7ada255ad"
+  "manifest_sha256": "ad4e2866217ec8778d76a3eb50c951b892d47bd9f786f38cfd3bd1e07e72bd95"
 }
\ No newline at end of file