diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1b9a4d3e98..5685bdb283 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -87,3 +87,25 @@ jobs:
       - name: Prove Herbatika Pages hard statuses through Docker ingress
         if: contains(steps.determine_affected.outputs.projects_csv, ',herbatika,')
         run: pnpm --filter=herbatika test:m00:wire
+
+  # Required status check for master (ruleset "Master"). It fails unless every
+  # job in `needs` succeeded, so the ruleset has one stable name to require.
+  # To make another job blocking, add it to `needs`; don't edit the ruleset.
+  quality-gate:
+    name: quality-gate
+    if: always()
+    needs:
+      - main
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Require every blocking job to pass
+        env:
+          NEEDS: ${{ toJSON(needs) }}
+        run: |
+          echo "$NEEDS" | jq -r 'to_entries[] | "\(.key): \(.value.result)"'
+          failed=$(echo "$NEEDS" | jq -r '[to_entries[] | select(.value.result != "success") | .key] | join(", ")')
+          if [ -n "$failed" ]; then
+            echo "::error::Blocking jobs did not succeed: $failed"
+            exit 1
+          fi