diff --git a/.github/workflows/deploy-pages.yml b/.github/workflows/deploy-pages.yml
index ea6897b..97ffd84 100644
--- a/.github/workflows/deploy-pages.yml
+++ b/.github/workflows/deploy-pages.yml
@@ -3,16 +3,28 @@ name: deploy-pages
 on:
   push:
     branches: [main]
+  # Build on every pull request too, so a change to the layout, the content,
+  # the Hugo version or one of the actions below has to prove the site still
+  # builds before it lands. Without this the workflow ran only on main, so a
+  # dependency bump arrived with no signal at all: its checks read "no checks",
+  # which is not the same thing as green and must not be merged as if it were.
+  pull_request:
   workflow_dispatch:
 
+# The build needs nothing beyond the source and the Pages configuration it
+# reads to compute the base URL. Publishing rights are granted to the deploy
+# job alone, below, so a pull request build cannot replace what is served even
+# if a step in it misbehaves.
 permissions:
   contents: read
-  pages: write
-  id-token: write
+  pages: read
 
+# Deploys serialise with one another under the main group. A pull request gets
+# a group of its own, so it neither waits behind a deploy nor holds one up, and
+# a new push to the same pull request supersedes the build still running for it.
 concurrency:
-  group: pages
-  cancel-in-progress: false
+  group: pages-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   build:
@@ -40,8 +52,16 @@ jobs:
           path: public
 
   deploy:
+    # Only main publishes. A pull request stops after the build above: it has
+    # proved the site builds, which is the whole point of the gate, and it has
+    # no business replacing the published site.
+    if: github.event_name != 'pull_request'
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}