diff --git a/.github/workflows/trigger.yml b/.github/workflows/trigger.yml
index ed1f274d..1bf5281c 100644
--- a/.github/workflows/trigger.yml
+++ b/.github/workflows/trigger.yml
@@ -14,22 +14,41 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  # Gate all builds through this check to prevent wasted runs.  Only run on
+  # 'labeled' events when the label is actually 'ci:main'.  Concurrency control
+  # above handles canceling the 'opened' event when 'labeled' arrives quickly
+  # after (e.g., when creating a PR with ci:main already attached). See #1154.
+  check-trigger:
+    if: |
+      startsWith(github.repository, 'kernelkit/') &&
+      (github.event_name != 'pull_request' ||
+       github.event.action != 'labeled' ||
+       github.event.label.name == 'ci:main')
+    runs-on: ubuntu-latest
+    steps:
+      - run: |
+          echo "Triggering build, logging meta data ..."
+          echo "Event  : ${{ github.event_name }}"
+          echo "Action : ${{ github.event.action }}"
+          echo "Ref    : ${{ github.ref }}"
+          echo "PR     : ${{ github.event.pull_request.number }}"
+          echo "Label  : ${{ github.event.label.name }}"
+
   build-x86_64:
-    if: startsWith(github.repository, 'kernelkit/')
+    needs: check-trigger
     uses: ./.github/workflows/build.yml
     with:
       name: "infix"
       target: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ci:main') && 'x86_64_minimal' || 'x86_64' }}
 
   build-aarch64:
-    if: startsWith(github.repository, 'kernelkit/')
+    needs: check-trigger
     uses: ./.github/workflows/build.yml
     with:
       name: "infix"
       target: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ci:main') && 'aarch64_minimal' || 'aarch64' }}
 
   test-run-x86_64:
-    if: startsWith(github.repository, 'kernelkit/')
     needs: build-x86_64
     uses: ./.github/workflows/test.yml
     with:
@@ -37,6 +56,5 @@ jobs:
       name: "infix"
 
   test-publish-x86_64:
-    if: startsWith(github.repository, 'kernelkit/')
     needs: test-run-x86_64
     uses: ./.github/workflows/publish.yml