@@ -1,7 +1,7 @@
 ##
 ## SECURITY MODEL FOR VERCEL PRODUCTION DEPLOYS (READ BEFORE EDITING)
 ##
-## This workflow runs on main pushes in this repository:
+## This workflow runs only on manual dispatch against main in this repository:
 ##  - The wrapper (checkout, nix, caches, build, Vercel pull + deploy, security
 ##    hardening) lives in the rainix `rainix-vercel.yaml` reusable workflow; this
 ##    file is a thin caller that selects the production environment and maps
@@ -10,28 +10,16 @@
 ##    workflow, never to the build step.
 ##
 ## WARNING: Changing any of the following may break the security model:
-##  - Triggers (the main push + webapp paths).
+##  - Triggers (manual dispatch only, main ref only).
 ##  - The reusable workflow ref / inputs.
 ## If you modify this file, re-validate these invariants (and those in rainix).
 name: GitHub Actions Vercel Production Deployment
+# Manual so front-end changes ship only once the contracts they call are deployed.
 on:
-  push:
-    branches:
-      - main
-    # Only redeploy prod when something webapp-relevant changed (see
-    # vercel-preview.yaml for the rationale) — a sol-only main merge shouldn't
-    # rebuild + redeploy the webapp.
-    paths:
-      - 'packages/**'
-      - 'crates/**'
-      - 'package.json'
-      - 'package-lock.json'
-      - 'flake.nix'
-      - 'flake.lock'
-      - 'script/vercel-build.sh'
-      - '.github/workflows/vercel-prod.yaml'
+  workflow_dispatch:
 jobs:
   production:
+    if: github.ref == 'refs/heads/main'
     uses: rainlanguage/rainix/.github/workflows/rainix-vercel.yaml@main
     with:
       environment: production