diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fdf8c7b..361b3af 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,13 +1,11 @@
+# Called by pr.yml on every pull request that is not documentation only;
+# dispatch it to run it on a branch without a pull request.
 name: CI
 run-name: "CI (${{ github.event_name }}) on ${{ github.ref_name }} by @${{ github.actor }}"
 
 on:
-  push:
-    branches: ["**"]
-    paths-ignore: ['**/*.md']
-  pull_request:
-    branches: ["**"]
-    paths-ignore: ['**/*.md']
+  workflow_call:
+  workflow_dispatch:
 
 permissions:
   contents: read
@@ -15,10 +13,11 @@ permissions:
 
 jobs:
   ci:
-    uses: otfabric/.github/.github/workflows/go-ci.yml@v3.3.1
+    uses: otfabric/.github/.github/workflows/go-ci.yml@v3.8.0
     with:
+      # otfabric-policy runs in docs.yml, on every pull request and push to main.
+      run-policy: false
       run-govulncheck: true
-      policy-version: v1.4.2
       fuzz-time: 10s
       coverage-min: "90"
       codecov-name: profinetctl
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 702eca7..f1fe0e5 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -1,19 +1,20 @@
 # Documents against the code (DOC-008, standards/documentation.md#doc-sync).
-# No path filter: this is the check that runs when ci.yml skips a
-# Markdown-only change, so branch protection can require it.
+# pr.yml calls it on every pull request; on main it runs on every push, with
+# no path filter.
 name: Docs
 on:
   push:
     branches: [main]
-  pull_request:
+  workflow_call:
+  workflow_dispatch:
 
 permissions:
   contents: read
 
 jobs:
   docs:
-    uses: otfabric/.github/.github/workflows/docs-check.yml@v3.5.0
+    uses: otfabric/.github/.github/workflows/docs-check.yml@v3.8.0
     with:
       docsync-version: v0.3.1
-      policy-version: v1.4.2
+      policy-version: v1.6.1
     secrets: inherit
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
new file mode 100644
index 0000000..1137909
--- /dev/null
+++ b/.github/workflows/pr.yml
@@ -0,0 +1,46 @@
+# The pull request gate (otfabric/.github PR workflow), generated by
+# otfabric/.github scripts/rollout/pr-workflow.py. No path filter: the light
+# checks always run, the heavy ones unless the change is documentation only,
+# then "OT Fabric Required Checks", the only check a ruleset requires.
+name: PR
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  changes:
+    uses: otfabric/.github/.github/workflows/pr-changes.yml@v3.8.0
+
+  ci:
+    needs: changes
+    if: needs.changes.outputs.full == 'true'
+    permissions:
+      contents: read
+      id-token: write
+    uses: ./.github/workflows/ci.yml
+    secrets: inherit
+
+  docs:
+    permissions:
+      contents: read
+    uses: ./.github/workflows/docs.yml
+    secrets: inherit
+
+  required:
+    name: OT Fabric Required Checks
+    needs: [changes, docs, ci]
+    if: always()
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: otfabric/.github/actions/required-gate@v3.8.0
+        with:
+          needs: ${{ toJSON(needs) }}
+          required: changes docs
+          required-for-code: ci
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8b2b6f0..533fc98 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -21,7 +21,7 @@ permissions:
 
 jobs:
   release-profinetctl-binary:
-    uses: otfabric/.github/.github/workflows/go-binary-release.yml@v3.6.0
+    uses: otfabric/.github/.github/workflows/go-binary-release.yml@v3.8.0
     with:
       bump: ${{ inputs.bump }}
       binary-name: profinetctl
diff --git a/.otfabric/policy.yaml b/.otfabric/policy.yaml
index f9c7aa3..4f623bd 100644
--- a/.otfabric/policy.yaml
+++ b/.otfabric/policy.yaml
@@ -1,5 +1,5 @@
 # OT Fabric engineering policy adoption (otfabric/engineering standards/README.md#adoption).
-policy: "1.4"
+policy: "1.6"
 profile: cli
 mode: enforce
 owner: bartvanbos
diff --git a/AGENTS.md b/AGENTS.md
index 88c442e..8a6ae7f 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -6,7 +6,7 @@ Command-line tool for PROFINET IO built on [go-profinet](https://github.com/otfa
 
 ## Organisation standards
 
-This repository follows **otfabric/engineering policy 1.4**, profile **cli** (`.otfabric/policy.yaml`, mode `enforce`). Where this file and the organisation standards disagree, this file wins here — say so in your report.
+This repository follows **otfabric/engineering policy 1.6**, profile **cli** (`.otfabric/policy.yaml`, mode `enforce`). Where this file and the organisation standards disagree, this file wins here — say so in your report.
 
 ## Where the truth lives
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 906d6ab..6b6020d 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -49,3 +49,14 @@ runs formatting (`fmt`, `fmt-check` with the gofmt of the Go version in go.mod),
 ## Commits and pull requests
 
 Small, focused commits with messages that say why. Pull requests run CI (`.github/workflows/ci.yml`); keep it green.
+
+## When CI runs
+
+| Event | Workflow | What runs |
+|---|---|---|
+| Pull request | `pr.yml` | `docs.yml` (docsync, otfabric-policy) always; `ci.yml` unless every changed file is documentation; then `OT Fabric Required Checks` |
+| Push to a branch | none | nothing; dispatch `ci.yml` to test a branch without a pull request |
+| Push to `main` | `docs.yml` | the light checks; the merged commit was tested as the pull request's merge commit |
+| Release | `release.yml` | the release workflow tests the release commit again |
+
+Documentation means an added or modified `*.md` file outside `.github/`, `testdata/` and `vendor/`, other than `AGENTS.md` and `CLAUDE.md`. A deleted or renamed document, or any other file, runs everything. `OT Fabric Required Checks` fails unless every job that applies succeeded; its summary lists them.