diff --git a/.forgejo/workflows/docker.yml b/.forgejo/workflows/docker.yml
index 84c8e81..53fa553 100644
--- a/.forgejo/workflows/docker.yml
+++ b/.forgejo/workflows/docker.yml
@@ -56,6 +56,13 @@ jobs:
     name: Deploy stage
     runs-on: [self-hosted, linux]
     needs: [api, web]
+    # Temporary guard: main currently contains references to VatRate etc. while
+    # the stage DB is already on Phase2c3_MsStrict (vat_rates dropped). Until
+    # the user lands the matching code changes on main, an auto-deploy of a
+    # freshly built image from main would break the API. Run deploy only on
+    # tag/dispatch; normal pushes still build + push images to the local
+    # registry, but don't roll the stage forward.
+    if: startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch'
     steps:
       - uses: actions/checkout@v4