diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml
index f12d3a4..bfad3a0 100644
--- a/.github/workflows/pull-request.yml
+++ b/.github/workflows/pull-request.yml
@@ -10,9 +10,3 @@ jobs:
     with:
       os: '["ubuntu-latest"]'
       skip-playwright: true
-
-  publish-gate:
-    if: startsWith(github.head_ref, 'changeset-release/')
-    uses: cyberuni/.github/.github/workflows/pnpm-publish-gate.yml@main
-    permissions:
-      contents: read
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ce8cc8a..8763fa4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -10,9 +10,22 @@ jobs:
       os: '["ubuntu-latest"]'
       skip-playwright: true
 
+  # Runs on the default branch immediately before `changeset publish`, so a tarball that
+  # trips the gate blocks the release. It used to sit on the changesets "Version
+  # Packages" PR instead, where it could never fire: a PR opened with the built-in
+  # GITHUB_TOKEN does not trigger `on: pull_request`, so that PR gets zero checks and
+  # the job attached to it was never once executed.
+  #
+  # A `needs:` of release, so it also runs on pushes that only open or update the
+  # Version PR rather than publish. Deliberate — it fails closed.
+  publish-gate:
+    uses: cyberuni/.github/.github/workflows/pnpm-publish-gate.yml@main
+    permissions:
+      contents: read
+
   release:
     uses: cyberuni/.github/.github/workflows/pnpm-release-changeset-oidc.yml@main
-    needs: code
+    needs: [code, publish-gate]
     permissions:
       id-token: write
       contents: write