diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6babfc0..aad0d23 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,5 +1,13 @@
 name: CI
-on: [push, pull_request]
+# Scope push to master only. With a bare `on: [push, pull_request]`, a commit to
+# a branch that has an open PR triggers CI twice (once for push, once for
+# pull_request) for the same SHA -- wasteful, and a flaky run can show red next
+# to an identical green one. PR branches now run only via pull_request; master
+# (post-merge) runs via push.
+on:
+  push:
+    branches: [master]
+  pull_request:
 jobs:
   test:
     strategy:
@@ -12,6 +20,23 @@ jobs:
       - name: Start PostgreSQL ${{ matrix.pg }}
         run: pg-start ${{ matrix.pg }}
       - name: Check out the repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       - name: Test on PostgreSQL ${{ matrix.pg }}
         run: pg-build-test
+
+  # A single stable check name for use as a required status check in branch
+  # protection. Matrix jobs produce names like "🐘 PostgreSQL 14" that change
+  # with the matrix; this aggregates them into one. It passes if every needed
+  # job succeeded or was skipped (e.g. a docs-only push with paths-ignore) and
+  # fails if any failed or were cancelled.
+  all-checks-passed:
+    needs: [test]
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check all jobs passed or were skipped
+        run: |
+          if [[ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" == "true" ]]; then
+            echo "One or more jobs failed or were cancelled"
+            exit 1
+          fi