diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index b7bacf8..01c4092 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -58,11 +58,13 @@ jobs:
     steps:
       - name: Require portions
         env:
+          AUTOFIX: ${{ needs.autofix.result }}
           CI: ${{ needs.ci.result }}
           STATIC: ${{ needs.static.result }}
           TERRAFORM: ${{ needs.terraform.result }}
         run: |
           set -euo pipefail
+          test "${AUTOFIX}" = success -o "${AUTOFIX}" = skipped
           test "${CI}" = success
           test "${STATIC}" = success
           test "${TERRAFORM}" = success
diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
index 607b17a..1e084d4 100644
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -14,9 +14,12 @@ on:
   push:
     branches: [main]
     paths-ignore:
+      # deploy.yaml is included so this transition commit does not start a
+      # prod deploy before the exec role can write the SSM contract.
       - "terraform/**"
       - "**/*.md"
       - ".github/workflows/ci.yaml"
+      - ".github/workflows/deploy.yaml"
       - ".github/workflows/labeler.yml"
       - ".github/workflows/dependency-review.yml"
   schedule: