diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 68699eb..1fcf272 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -376,11 +376,23 @@ jobs:
   bump:
     runs-on: ubuntu-latest
     needs: [image]
-    if: github.ref == 'refs/heads/master' && github.event_name == 'push'
+    # The master+push guard lives on the STEPS, not on the job.
+    #
+    # A job-level `if` here evaluated false and skipped `bump` at 0s — before `image` had
+    # even started — on a genuine push to master (`event: push`, `head_branch: master`).
+    # The identical expression on the `push by digest` STEP inside the matrix job evaluates
+    # true and runs. Gitea appears not to resolve a job-level `if` correctly when `needs`
+    # points at a matrix job.
+    #
+    # `needs: [image]` still does the ordering and still gates on all three legs passing.
+    # The steps below carry the branch guard, in the form this runner is known to evaluate
+    # correctly. On a PR the job starts and every step no-ops, which costs a few seconds
+    # and is the price of a guard that actually fires.
     permissions:
       contents: write
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        if: github.ref == 'refs/heads/master' && github.event_name == 'push'
         with:
           # A bot token with contents:write on this repo and nothing else: no kubeconfig,
           # no cluster credential, no ArgoCD API token. CI's maximum blast radius is a bad
@@ -388,11 +400,13 @@ jobs:
           token: ${{ secrets.CI_BOT_TOKEN }}
           ref: master
       - uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        if: github.ref == 'refs/heads/master' && github.event_name == 'push'
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ secrets.REGISTRY_USER }}
           password: ${{ secrets.REGISTRY_TOKEN }}
       - name: bump image digests in the chart
+        if: github.ref == 'refs/heads/master' && github.event_name == 'push'
         env:
           REGISTRY: ${{ env.REGISTRY }}
           IMAGE_NS: ${{ env.IMAGE_NS }}