diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 06e6d64..532b8ad 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -1,10 +1,11 @@
 name: Deploy
 
-# FR-1/FR-12 — one workflow owns every deploy:
-#   - push to main    → production deploy (*.pages.dev until the domain lands)
-#   - pull_request    → preview deploy on a branch URL
+# FR-1/FR-12 — one workflow owns every production deploy:
+#   - push to main    → production deploy (runs when a PR is merged to main)
 #   - hourly schedule → fresh build (news/release/docs refresh) + production deploy
 #   - workflow_dispatch → "right now" button
+# pull_request is deliberately NOT a trigger: PRs are validated by CI (ci.yml),
+# which builds and uploads a `site-preview` artifact — no per-PR preview deploys.
 #
 # One-time setup (repo Settings, no Cloudflare dashboard clicks needed):
 #   Secrets:   CLOUDFLARE_API_TOKEN (Cloudflare Pages: Edit), CLOUDFLARE_ACCOUNT_ID
@@ -14,7 +15,6 @@ name: Deploy
 on:
   push:
     branches: [main]
-  pull_request:
   schedule:
     # Hourly at :07, off the top of the hour.
     - cron: "7 * * * *"
diff --git a/docs/superpowers/specs/2026-08-19-website-prd.md b/docs/superpowers/specs/2026-08-19-website-prd.md
index 052a0f2..f7de75d 100644
--- a/docs/superpowers/specs/2026-08-19-website-prd.md
+++ b/docs/superpowers/specs/2026-08-19-website-prd.md
@@ -61,8 +61,11 @@ called Keel (keel.sh) and currently owns the bare-"keel" search results.
 ## 5. Functional requirements
 
 ### FR-1 Architecture
-Static-first Astro site, deployed on Cloudflare Pages from this repo's `main`; every PR
-gets a preview deployment. No server-side runtime except (optionally) one Cloudflare
+Static-first Astro site, deployed on Cloudflare Pages from this repo's `main`; deploys
+run when a PR is merged to `main` (plus an hourly content refresh and manual dispatch).
+PRs are validated by CI, which uploads a build artifact for inspection — no per-PR
+preview deployments (amended 2026-08-20; originally "every PR gets a preview
+deployment"). No server-side runtime except (optionally) one Cloudflare
 Worker scoped to proxying GitHub GraphQL/REST reads with the token (FR-5/6).
 
 ### FR-2 Site map (v1)