diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index b9d66f7..9fe2866 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -1,7 +1,10 @@
 name: Deploy
 
+# Depends on ci.yml — only runs after CI passes on main.
 on:
-  push:
+  workflow_run:
+    workflows: ["CI"]
+    types: [completed]
     branches: [main]
 
 permissions:
@@ -16,6 +19,7 @@ concurrency:
 
 jobs:
   build-and-deploy:
+    if: github.event.workflow_run.conclusion == 'success'
     runs-on: ubuntu-latest
     environment:
       name: github-pages