diff --git a/.gitea/workflows/production-candidate.yml b/.gitea/workflows/production-candidate.yml
index 6ee5978..75d9bbb 100644
--- a/.gitea/workflows/production-candidate.yml
+++ b/.gitea/workflows/production-candidate.yml
@@ -1,6 +1,9 @@
 name: Deploy primary production Worker candidate
 
 on:
+  push:
+    branches: [astro-platform-pilot]
+    paths: [.gitea/workflows/production-candidate.yml]
   workflow_dispatch:
 
 jobs:
diff --git a/docs/cutover-runbook.md b/docs/cutover-runbook.md
index e278dc4..a35fcc7 100644
--- a/docs/cutover-runbook.md
+++ b/docs/cutover-runbook.md
@@ -20,8 +20,10 @@ static assets to a distinct Worker.
 - Existing Pages production deployment: `2fb1b659-5928-4470-bb04-ef4c9105b843`
   from the `main` branch.
 - Preview Worker: `3031023-xyz-www-preview`, with no custom domains or routes.
-- Production candidate Worker: `3031023-xyz`, deployed only through the manual
-  `Deploy primary production Worker candidate` workflow.
+- Production candidate Worker: `3031023-xyz`, deployed only through the
+  dedicated `Deploy primary production Worker candidate` workflow. Its push
+  trigger is limited to changes to that workflow file; ordinary site commits
+  cannot update this Worker.
 
 ## Cutover sequence (requires separate approval)