diff --git a/template/.github/workflows/ci.yml.jinja b/template/.github/workflows/ci.yml.jinja
index e212ca7..cd15e68 100644
--- a/template/.github/workflows/ci.yml.jinja
+++ b/template/.github/workflows/ci.yml.jinja
@@ -56,7 +56,10 @@ jobs:
           set -e
           test $STATUS -eq 0 -o $STATUS -eq 5
 
-  # Sentinel job — use this as the single required status check in branch protection.
+  # Sentinel job — the single required status check in the master ruleset. A job
+  # counts only when it succeeded: "skipped" means the work did not happen. A job
+  # skipped by design (one that runs on pull requests only, say) goes in MAY_SKIP
+  # by its job id, and only those may end skipped.
   all-checks-passed:
     name: All checks passed
     if: always()
@@ -64,9 +67,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check all jobs succeeded
+        env:
+          NEEDS: ${% raw %}{{ toJSON(needs) }}{% endraw %}
+          MAY_SKIP: '[]'
         run: |
-          if [[ "${% raw %}{{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}{% endraw %}" == "true" ]]; then
-            echo "One or more required checks failed."
+          NOT_PASSED=$(jq -r --argjson skip "$MAY_SKIP" '
+            to_entries[]
+            | select((.value.result == "success" or (.value.result == "skipped" and (.key | IN($skip[])))) | not)
+            | "\(.key): \(.value.result)"' <<< "$NEEDS")
+          if [ -n "$NOT_PASSED" ]; then
+            echo "Not passed:"
+            echo "$NOT_PASSED"
             exit 1
           fi
           echo "All checks passed."