diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index dbc92f4..649cde5 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -10,6 +10,12 @@ on:
       - 'Cargo.lock'
       - 'bundler.toml'
       - 'tools/**'
+      # This workflow validates itself: a broken step, a moved script path or a
+      # wrong runner label then fails loudly on the commit that caused it, rather
+      # than surfacing later against an unrelated source change. Note the limit -
+      # it checks the job body, not the trigger block above. Break `on:` and the
+      # symptom is silence, which looks like success.
+      - '.github/workflows/**'
   # Mirrors the push filter. Without it a PR touching only the README would run a
   # full build - the branch filter alone constrains where, not what.
   pull_request:
@@ -21,6 +27,7 @@ on:
       - 'Cargo.lock'
       - 'bundler.toml'
       - 'tools/**'
+      - '.github/workflows/**'
   workflow_dispatch:
 
 # Target the self-hosted Rust/audio runner registered to the `musiikki` org.