diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dc37c38..c67d461 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,6 +8,7 @@ on:
 
 jobs:
   lint:
+    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk'
     name: Lint
     runs-on: ubuntu-latest
     steps:
@@ -27,6 +28,7 @@ jobs:
         run: npm run lint
 
   typecheck:
+    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk'
     name: Type Check
     runs-on: ubuntu-latest
     steps:
@@ -46,6 +48,7 @@ jobs:
         run: npm run typecheck
 
   test:
+    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk'
     name: Test (Node ${{ matrix.node-version }})
     runs-on: ubuntu-latest
     strategy:
@@ -75,6 +78,7 @@ jobs:
         run: npm run test:run
 
   build:
+    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk'
     name: Build
     runs-on: ubuntu-latest
     steps:
@@ -103,7 +107,9 @@ jobs:
     name: CI Success
     needs: [lint, typecheck, test, build]
     runs-on: ubuntu-latest
-    if: always()
+    if: >-
+      ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') &&
+      (always())
     steps:
       - name: Check all jobs passed
         run: |
diff --git a/.github/workflows/compact-on-merge.yml b/.github/workflows/compact-on-merge.yml
index baa6548..fbf5b31 100644
--- a/.github/workflows/compact-on-merge.yml
+++ b/.github/workflows/compact-on-merge.yml
@@ -9,7 +9,9 @@ on:
 jobs:
   compact:
     # Only run when PR is actually merged, not just closed
-    if: github.event.pull_request.merged == true
+    if: >-
+      ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') &&
+      (github.event.pull_request.merged == true)
     runs-on: ubuntu-latest
 
     permissions:
diff --git a/.github/workflows/trunk-guard.yml b/.github/workflows/trunk-guard.yml
new file mode 100644
index 0000000..2ddb497
--- /dev/null
+++ b/.github/workflows/trunk-guard.yml
@@ -0,0 +1,17 @@
+name: Trunk guard
+
+# Only the `trunk` branch may merge into main. Feature branches merge into
+# `trunk` (via the merge train); CI runs only on the trunk -> main PR.
+on:
+  pull_request:
+    branches: [main]
+
+jobs:
+  only-trunk-merges-to-main:
+    if: github.head_ref != 'trunk'
+    runs-on: ubuntu-latest
+    timeout-minutes: 1
+    steps:
+      - run: |
+          echo "::error::Only the 'trunk' branch may merge into main. Retarget this PR to 'trunk'."
+          exit 1