diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml
index 40a158b..6c455b8 100644
--- a/.gitea/workflows/deploy.yaml
+++ b/.gitea/workflows/deploy.yaml
@@ -138,9 +138,10 @@ jobs:
   # lets it start after a failed dependency; the needs on apply-compose are a
   # barrier, so verification begins only once both applies are done.
   verify-k8s:
-    needs: [apply-k8s, apply-compose]
+    needs: [preflight, apply-k8s, apply-compose]
     if: >-
       always() &&
+      needs.preflight.result == 'success' &&
       needs.apply-k8s.result != 'skipped' &&
       needs.apply-compose.result != 'skipped'
     runs-on: [self-hosted, linux, arch, homelab, prod]
@@ -183,8 +184,11 @@ jobs:
   # suppressing them on a rollback would hide the one run where the answer
   # matters most.
   smoke:
-    needs: [verify-k8s]
-    if: always() && needs.verify-k8s.result != 'skipped'
+    needs: [preflight, verify-k8s]
+    if: >-
+      always() &&
+      needs.preflight.result == 'success' &&
+      needs.verify-k8s.result != 'skipped'
     runs-on: [self-hosted, linux, arch, homelab, prod]
     timeout-minutes: 10
     steps: