diff --git a/template/.github/workflows/docs.yml b/template/.github/workflows/docs.yml
index 0b71e78..ba8700d 100644
--- a/template/.github/workflows/docs.yml
+++ b/template/.github/workflows/docs.yml
@@ -3,22 +3,31 @@ name: Docs
 on:
   push:
     branches: [master]
+  workflow_dispatch:
 
 permissions:
   contents: read
   pages: write
   id-token: write
 
+# Two quick pushes must not race each other onto Pages.
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
       - uses: astral-sh/setup-uv@v7
-      - run: uv sync --no-dev --group docs
+      # --locked: fail when uv.lock is out of date with pyproject.toml.
+      - run: uv sync --locked --no-dev --group docs
       - run: cp CHANGELOG.md docs/changelog.md
-      - run: uv run zensical build --clean
-      - run: uv run python scripts/emit_markdown.py
+      # --no-dev on `uv run` too: without it the implicit sync reinstalls the
+      # whole dev group just to build docs.
+      - run: uv run --no-dev --group docs zensical build --clean
+      - run: uv run --no-dev --group docs python scripts/emit_markdown.py
       - uses: actions/upload-pages-artifact@v5
         with:
           path: site