diff --git a/.gitea/workflows/ci-stage.yaml b/.gitea/workflows/ci-stage.yaml
index 99a4a06..69ed162 100644
--- a/.gitea/workflows/ci-stage.yaml
+++ b/.gitea/workflows/ci-stage.yaml
@@ -16,6 +16,16 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Enforce source branch (stage ← dev only)
+        if: github.event_name == 'pull_request'
+        run: |
+          SOURCE="${GITHUB_HEAD_REF}"
+          if [ "${SOURCE}" != "dev" ]; then
+            echo "ERROR: Stage branch only accepts PRs from 'dev'. Source was: '${SOURCE}'"
+            exit 1
+          fi
+          echo "Source branch check passed: ${SOURCE} → stage"
+
       - name: Install build dependencies
         run: |
           apt-get update -qq
diff --git a/.gitea/workflows/engram-release.yaml b/.gitea/workflows/engram-release.yaml
index 4de119c..bdf3258 100644
--- a/.gitea/workflows/engram-release.yaml
+++ b/.gitea/workflows/engram-release.yaml
@@ -16,6 +16,16 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Enforce source branch (main ← stage only)
+        if: github.event_name == 'pull_request'
+        run: |
+          SOURCE="${GITHUB_HEAD_REF}"
+          if [ "${SOURCE}" != "stage" ]; then
+            echo "ERROR: Main branch only accepts PRs from 'stage'. Source was: '${SOURCE}'"
+            exit 1
+          fi
+          echo "Source branch check passed: ${SOURCE} → main"
+
       - name: Install build dependencies
         run: |
           apt-get update -qq