diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 8dde6e41..2a692a9c 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -7,8 +7,13 @@ on:
       - publish-test
 
 jobs:
+  e2e:
+    name: "Gate: k8s deploy e2e"
+    uses: ./.github/workflows/test-k8s-deploy.yml
+
   publish:
     name: "Build and publish"
+    needs: e2e
     runs-on: ubuntu-latest
     steps:
       - name: "Clone project repository"
diff --git a/.github/workflows/test-k8s-deploy.yml b/.github/workflows/test-k8s-deploy.yml
index 6bc40ed2..3b25469c 100644
--- a/.github/workflows/test-k8s-deploy.yml
+++ b/.github/workflows/test-k8s-deploy.yml
@@ -1,10 +1,10 @@
 name: K8s Deploy Test
 
 on:
-  pull_request:
-    branches: '*'
-  push:
-    branches: '*'
+  # Manual trigger for ad-hoc validation
+  workflow_dispatch:
+  # Called by publish workflow to gate releases
+  workflow_call:
 
 jobs:
   test: