diff --git a/.github/workflows/hugo.yml b/.github/workflows/hugo.yml
index dc48768..4fc10af 100644
--- a/.github/workflows/hugo.yml
+++ b/.github/workflows/hugo.yml
@@ -7,6 +7,12 @@ name: Deploy Hugo site to Pages
 on:
   push:
     branches: [main]
+  # Build on every pull request too, so a change to the layout, the content or
+  # the Hugo version has to prove the site still builds before it lands.
+  # Without this the workflow ran only on main, which meant a dependency bump
+  # arrived with no signal at all -- its checks read "no checks", which is not
+  # the same thing as green and must not be merged as if it were.
+  pull_request:
   workflow_dispatch:
 
 # Allow only one concurrent deployment, skipping runs queued between
@@ -61,6 +67,10 @@ jobs:
           path: ./public
 
   deploy:
+    # Only main publishes. A pull request stops after build above: it has built
+    # the site and uploaded the artifact, which is the whole point of the gate,
+    # and it has no business replacing what is served.
+    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}