diff --git a/.forgejo/workflows/test.yaml b/.forgejo/workflows/test.yaml
index df39979..a24b1a8 100644
--- a/.forgejo/workflows/test.yaml
+++ b/.forgejo/workflows/test.yaml
@@ -3,8 +3,14 @@
 
 name: test
 
+# A change is tested once: as a pull request while it is one, and on main
+# after it merges, which is also what publishes the source. A branch push is
+# not tested on its own, since it would only repeat its pull request's run on
+# another runner; nothing reaches main except through a pull request.
 on:
   push:
+    branches:
+      - main
   pull_request:
   workflow_dispatch:
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 2dd9897..c1b1ea2 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -125,8 +125,9 @@ validates them, and against the rules here: the identifier is
 version, and the files agree. The installers of the versions changed since
 `origin/main` must download from git.jcollie.dev and hash to the SHA-256 their
 manifest gives, so those are downloaded; without `--changed-since` every
-version's installers are. CI runs the same check on every push and pull
-request.
+version's installers are. CI runs the same check on every pull request, and
+on `main` once it merges; a branch is checked through its pull request rather
+than on each push, so that a change is not tested twice.
 
 `main` only moves through a merged pull request that has passed validation.
 Branch protection enforces it for everyone, the repository's owner included: