diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml
index 5120d32..362eaf7 100644
--- a/.gitea/workflows/deploy.yaml
+++ b/.gitea/workflows/deploy.yaml
@@ -39,10 +39,15 @@ env:
 
 jobs:
   preflight:
+    # Kill-switch for autodeploy: set the AUTODEPLOY repo variable to 'false'
+    # (Settings -> Actions -> Variables) and pushes stop reaching the cluster
+    # with no commit. Unset means on. A manual Run workflow always bypasses
+    # the switch: dispatching it is the explicit intent to deploy.
     if: >-
-      github.event_name != 'workflow_run' ||
+      (vars.AUTODEPLOY != 'false' || github.event_name == 'workflow_dispatch') &&
+      (github.event_name != 'workflow_run' ||
       (github.event.workflow_run.conclusion == 'success' &&
-       github.event.workflow_run.head_branch == 'main')
+       github.event.workflow_run.head_branch == 'main'))
     runs-on: [self-hosted, linux, arch, homelab, prod]
     timeout-minutes: 10
     steps: