diff --git a/.github/workflows/build-attest-dist.yaml b/.github/workflows/build-attest-dist.yaml
index da9b179..ac3a328 100644
--- a/.github/workflows/build-attest-dist.yaml
+++ b/.github/workflows/build-attest-dist.yaml
@@ -9,6 +9,7 @@ on:
       - 'attest/index.js'
       - 'attest/package.json'
       - 'attest/package-lock.json'
+      - '.github/workflows/build-attest-dist.yaml'
   workflow_dispatch:
 
 permissions:
@@ -50,6 +51,8 @@ jobs:
         if: github.event_name == 'pull_request'
         env:
           PR_HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
+          PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
           BASE_REPO: ${{ github.repository }}
         run: |
           # SECURITY: only act if the rebuild produced exactly one
@@ -88,4 +91,9 @@ jobs:
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git add attest/dist/index.js
           git commit -m "chore(attest): rebuild dist/index.js"
-          git push
+          # The checkout is the PR head SHA, a detached HEAD, so name the
+          # PR branch. The lease makes the push land only while the branch
+          # still points at the SHA this run built from; if it moved in any
+          # direction or was deleted, the push is rejected.
+          git push --force-with-lease="refs/heads/$PR_HEAD_REF:$PR_HEAD_SHA" \
+            origin "HEAD:refs/heads/$PR_HEAD_REF"