diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml
index cd297d60..bab58641 100644
--- a/.github/workflows/deploy-docs.yml
+++ b/.github/workflows/deploy-docs.yml
@@ -1,34 +1,46 @@
+# Generated by the rollout-deploy-docs-trigger workflow in
+# spring-cloud/spring-cloud-github-actions.
+#
+# Do not edit this file directly - update examples/deploy-docs-trigger.yml
+# there and re-run the rollout, otherwise your change will be overwritten.
+
 name: Deploy Docs
+
 on:
   push:
-    branches-ignore:
-      - gh-pages
-      - 'release/**'
-      - '**-internal**'
+    # Allow-list of exactly this branch. A topic or Dependabot branch cut from
+    # it carries this file too, and without this filter every push to one of
+    # those would dispatch a full docs build for a ref that is not in the
+    # Antora playbook.
+    branches:
+      - main
     tags: '**'
   repository_dispatch:
     types: request-build-reference # legacy
-  #schedule:
-  #- cron: '0 10 * * *' # Once per day at 10am UTC
   workflow_dispatch:
+
 permissions:
-  actions: write
+  contents: read   # required to check out private commercial repositories
+  actions: write   # required to dispatch the docs build
+
 jobs:
   build:
     runs-on: ubuntu-latest
-    # FIXME: enable when pushed to spring-projects
-    # if: github.repository_owner == 'spring-projects'
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: docs-build
           fetch-depth: 1
+
+      # A branch push rebuilds just that branch's docs; a tag push rebuilds
+      # everything so the new version appears in the version dropdown.
       - name: Dispatch (partial build)
         if: github.ref_type == 'branch'
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: gh workflow run deploy-docs.yml -r $(git rev-parse --abbrev-ref HEAD) -f build-refname=${{ github.ref_name }}
+
       - name: Dispatch (full build)
         if: github.ref_type == 'tag'
         env: