diff --git a/.editorconfig b/.editorconfig
index c3d3f14..369bca5 100644
--- a/.editorconfig
+++ b/.editorconfig
@@ -1,18 +1,18 @@
-root = true
-
-[*]
-charset = utf-8
-end_of_line = lf
-indent_style = space
-indent_size = 4
-trim_trailing_whitespace = true
-insert_final_newline = true
-
-[*.{yaml,yml,toml,json}]
-indent_size = 2
-
-[Makefile]
-indent_style = tab
-
-[*.md]
-trim_trailing_whitespace = false
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_style = space
+indent_size = 4
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[*.{yaml,yml,toml,json}]
+indent_size = 2
+
+[Makefile]
+indent_style = tab
+
+[*.md]
+trim_trailing_whitespace = false
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index de012d0..ba8700d 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -1,34 +1,43 @@
-name: Docs
-
-on:
-  push:
-    branches: [master]
-
-permissions:
-  contents: read
-  pages: write
-  id-token: write
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@v7
-      - run: uv sync --no-dev --group docs
-      - run: cp CHANGELOG.md docs/changelog.md
-      - run: uv run zensical build --clean
-      - run: uv run python scripts/emit_markdown.py
-      - uses: actions/upload-pages-artifact@v5
-        with:
-          path: site
-
-  deploy:
-    needs: build
-    runs-on: ubuntu-latest
-    environment:
-      name: github-pages
-      url: ${{ steps.deployment.outputs.page_url }}
-    steps:
-      - id: deployment
-        uses: actions/deploy-pages@v5
+name: Docs
+
+on:
+  push:
+    branches: [master]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+# Two quick pushes must not race each other onto Pages.
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v7
+      # --locked: fail when uv.lock is out of date with pyproject.toml.
+      - run: uv sync --locked --no-dev --group docs
+      - run: cp CHANGELOG.md docs/changelog.md
+      # --no-dev on `uv run` too: without it the implicit sync reinstalls the
+      # whole dev group just to build docs.
+      - run: uv run --no-dev --group docs zensical build --clean
+      - run: uv run --no-dev --group docs python scripts/emit_markdown.py
+      - uses: actions/upload-pages-artifact@v5
+        with:
+          path: site
+
+  deploy:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - id: deployment
+        uses: actions/deploy-pages@v5
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 48901c5..8947d93 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -1,18 +1,18 @@
-name: Release Please
-
-on:
-  push:
-    branches: [master]
-
-permissions:
-  contents: write
-  pull-requests: write
-
-jobs:
-  release-please:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: googleapis/release-please-action@v5
-        with:
-          config-file: release-please-config.json
-          manifest-file: .release-please-manifest.json
+name: Release Please
+
+on:
+  push:
+    branches: [master]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: googleapis/release-please-action@v5
+        with:
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json