diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0a8ef9c..4e706dd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -3,12 +3,10 @@
 # scripts/ci/, so the entire pipeline is reproducible by running the same scripts
 # locally — no marketplace build/test/push actions.
 #
-# Gitea (origin) is the internal remote and runs the full pipeline: build, test,
-# coverage badge, docker push, deploy, health check. GitHub is the public mirror and
-# only needs to prove the code builds and tests pass — it has no registry secrets and
-# no [self-hosted, qa] runner, so the docker push/deploy job is skipped there via the
+# Gitea (origin) is the only remote that runs this on push — gated by the
 # `github.server_url` check below (identical on both engines: https://github.com on
-# GitHub, the Gitea instance URL on Gitea).
+# GitHub, the Gitea instance URL on Gitea). GitHub pushes intentionally do nothing for
+# now; GitHub will get its own release-triggered workflow later.
 name: CI
 
 on:
@@ -17,6 +15,7 @@ on:
 
 jobs:
   build-and-push:
+    if: github.server_url != 'https://github.com'
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -43,16 +42,16 @@ jobs:
         run: ./scripts/ci/publish-coverage-badge.sh
 
       - name: Build Docker images
-        if: github.server_url != 'https://github.com' && github.ref_name == 'main'
+        if: github.ref_name == 'main'
         run: ./scripts/ci/docker-build.sh
 
       - name: Push Docker images
-        if: github.server_url != 'https://github.com' && github.ref_name == 'main'
+        if: github.ref_name == 'main'
         run: ./scripts/ci/docker-push.sh
 
   deploy:
     needs: build-and-push
-    if: github.server_url != 'https://github.com' && github.ref_name == 'main'
+    if: success() && github.ref_name == 'main'
     runs-on: [self-hosted, qa]
     env:
       REGISTRY: ${{ secrets.REGISTRY }}