diff --git a/.github/workflows/devkit-ci.yml b/.github/workflows/devkit-ci.yml
index da85578..2572d16 100644
--- a/.github/workflows/devkit-ci.yml
+++ b/.github/workflows/devkit-ci.yml
@@ -81,3 +81,41 @@ jobs:
         run: |
           npm install --no-save @anthropic-ai/claude-code@2.1.285
           ./node_modules/.bin/claude plugin validate . --strict
+
+  python:
+    if: github.event_name == 'pull_request'
+    uses: ./.github/workflows/python-ci.yml
+    with:
+      # wiring.py imports yaml; the flake's python has it, a bare setup-python does not.
+      self-test-commands: |
+        pip install "pyyaml==6.0.3"
+        bash tests/self-tests.sh
+
+  static:
+    if: github.event_name == 'pull_request'
+    uses: ./.github/workflows/static-ci.yml
+    with:
+      shellcheck-files: scripts/*.sh scripts/lib/*.sh .githooks/* plugins/marola-devkit/hooks/*.sh
+
+  agents:
+    if: github.event_name == 'pull_request'
+    uses: ./.github/workflows/agents-check.yml
+    with:
+      devkit-ref: ${{ github.event.pull_request.head.sha }}
+
+  # The one check ci-rule requires in every marola repo (marola-dev/marola#813); it must report on
+  # every run, so it needs every other job and passes on skipped ones.
+  ci-ok:
+    if: always()
+    needs: [check, python, static, agents]
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions: {}
+    steps:
+      - name: every needed job passed or was skipped
+        env:
+          RESULTS: ${{ join(needs.*.result, ' ') }}
+        run: |
+          for r in $RESULTS; do
+            case "$r" in success|skipped) ;; *) echo "::error::a needed job ended $r"; exit 1 ;; esac
+          done
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index ad3d7e5..79c9faa 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -10,27 +10,6 @@ permissions:
   contents: read
 
 jobs:
-  python:
-    if: github.event.action != 'closed'
-    uses: ./.github/workflows/python-ci.yml
-    with:
-      # wiring.py imports yaml; the flake's python has it, a bare setup-python does not.
-      self-test-commands: |
-        pip install "pyyaml==6.0.3"
-        bash tests/self-tests.sh
-
-  static:
-    if: github.event.action != 'closed'
-    uses: ./.github/workflows/static-ci.yml
-    with:
-      shellcheck-files: scripts/*.sh scripts/lib/*.sh .githooks/* plugins/marola-devkit/hooks/*.sh
-
-  agents:
-    if: github.event.action != 'closed'
-    uses: ./.github/workflows/agents-check.yml
-    with:
-      devkit-ref: ${{ github.event.pull_request.head.sha }}
-
   body:
     if: github.event.action != 'closed'
     uses: ./.github/workflows/pr-body.yml
diff --git a/README.md b/README.md
index 1e67c9a..f79984b 100644
--- a/README.md
+++ b/README.md
@@ -206,8 +206,9 @@ jobs:
       devkit-ref: v0.9.0
 ```
 
-This repo calls five of them on its own pull requests (`.github/workflows/pr.yml`: `python-ci`,
-`static-ci`, `agents-check`, `pr-body`, `ci-short-circuit`) and `labels-sync` by hand
+This repo calls five of them on its own pull requests (`python-ci`, `static-ci` and
+`agents-check` in `.github/workflows/devkit-ci.yml` under `ci-ok`; `pr-body` and `ci-short-circuit`
+in `.github/workflows/pr.yml`) and `labels-sync` by hand
 (`labels.yml`), so a change to those is exercised by a real caller before a tag is cut.
 `scala-ci`, `notify-umbrella` and `api-docs` have no caller here: no Scala, no API docs
 generator, and nothing to announce, since the umbrella's docs take the devkit at its pinned
diff --git a/docs/3-development.md b/docs/3-development.md
index ffde7a0..c2fc26b 100644
--- a/docs/3-development.md
+++ b/docs/3-development.md
@@ -40,8 +40,8 @@ at the real repo, and `git -C <tmp> config` once rewrote this repo's `.git/confi
   `flake.lock` is current for `flake.nix`, runs `nix flake check` (the package build and the
   self-tests derivation), then `just quality`, `tests/self-tests.sh` and `agents-check` inside the
   dev shell, and `claude plugin validate . --strict` with a pinned Claude Code release.
-- **`pr.yml`** calls five of the reusable workflows on this repo's own pull requests
-  (`python-ci`, `static-ci`, `agents-check`, `pr-body`, `ci-short-circuit`), at the PR's head, so
+- **`devkit-ci.yml`** runs `python-ci`, `static-ci` and `agents-check` under `ci-ok`, and
+  **`pr.yml`** keeps the `pr-body` and `ci-short-circuit` calls, all at the PR's head, so
   a change to one of them runs in a real caller before a tag. `labels.yml` calls `labels-sync` by
   hand (`workflow_dispatch`). `scala-ci`, `notify-umbrella` and `api-docs` have no caller here.