diff --git a/.github/workflows/job-reruns.yml b/.github/workflows/job-reruns.yml
index 4beb901..db24fca 100644
--- a/.github/workflows/job-reruns.yml
+++ b/.github/workflows/job-reruns.yml
@@ -10,6 +10,12 @@ on:
     paths:
       - '.github/workflows/job-reruns.yml'
       - '.github/scripts/job_reruns.py'
+      - '.github/scripts/test_job_reruns.py'
+  pull_request:
+    paths:
+      - '.github/workflows/job-reruns.yml'
+      - '.github/scripts/job_reruns.py'
+      - '.github/scripts/test_job_reruns.py'
   issues:
     types: [edited]
   workflow_dispatch:
@@ -23,19 +29,41 @@ permissions:
   issues: write
 
 # Several scheduled workflows can finish together. Keep their issue updates in order so a
-# slower API response cannot overwrite a newer view of the runs.
+# slower API response cannot overwrite a newer view of the runs. PR validation has its own
+# per-branch group so it neither blocks nor gets blocked by those live updates.
 concurrency:
-  group: job-reruns-dashboard
-  cancel-in-progress: false
+  group: >-
+    ${{ github.event_name == 'pull_request'
+        && format('job-reruns-validation-{0}', github.ref)
+        || 'job-reruns-dashboard' }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
+  validate:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7.0.1
+
+      - name: Test dashboard logic
+        run: python3 .github/scripts/test_job_reruns.py
+
   update-issue:
+    if: github.event_name != 'pull_request'
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout
         uses: actions/checkout@v7.0.1
 
+      # Cheap enough to gate every live invocation, including issue edits and workflow-run
+      # completions. A broken dashboard helper should fail before it mutates the tracking issue
+      # or dispatches another workflow.
+      - name: Test dashboard logic
+        run: python3 .github/scripts/test_job_reruns.py
+
       - name: Dispatch selected jobs and update issue
         env:
           GH_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/network.yml b/.github/workflows/network.yml
index 16be58a..7085757 100644
--- a/.github/workflows/network.yml
+++ b/.github/workflows/network.yml
@@ -14,10 +14,26 @@ on:
       - main
     paths:
       - 'network/**'
+      - 'build.gradle.kts'
+      - 'settings.gradle.kts'
+      - 'gradle/**'
+      - 'gradlew'
+      - 'gradlew.bat'
+      - 'conscrypt/fetch-conscrypt.sh'
+      - 'conscrypt/release-tag.sh'
+      - 'conscrypt/pinned.properties'
       - '.github/workflows/network.yml'
   pull_request:
     paths:
       - 'network/**'
+      - 'build.gradle.kts'
+      - 'settings.gradle.kts'
+      - 'gradle/**'
+      - 'gradlew'
+      - 'gradlew.bat'
+      - 'conscrypt/fetch-conscrypt.sh'
+      - 'conscrypt/release-tag.sh'
+      - 'conscrypt/pinned.properties'
       - '.github/workflows/network.yml'
   schedule:
     # Daily, so a change at one of the servers these tests call — or in a published
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index fbfac6f..c126a8b 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -14,6 +14,10 @@ on:
     paths:
       - 'site/**'
       - '.github/workflows/pages.yml'
+  pull_request:
+    paths:
+      - 'site/**'
+      - '.github/workflows/pages.yml'
   workflow_dispatch:
 
 permissions:
@@ -26,10 +30,14 @@ permissions:
   issues: read
 
 # Never two deploys at once, and never cancel one half-done: the deployed site carries the
-# history, so a cancelled deploy would lose whatever it was about to publish.
+# history, so a cancelled deploy would lose whatever it was about to publish. PR validation
+# has its own per-branch group so it cannot hold up a production deployment.
 concurrency:
-  group: pages
-  cancel-in-progress: false
+  group: >-
+    ${{ github.event_name == 'pull_request'
+        && format('pages-validation-{0}', github.ref)
+        || 'pages' }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 env:
   # Every workflow whose results the page reports. Each one's most recent completed run on
@@ -38,15 +46,33 @@ env:
   TEST_WORKFLOWS: containers.yml network.yml android-ech.yml
 
 jobs:
+  validate:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7.0.1
+
+      - name: Validate result collector
+        run: python3 -m compileall -q site/tools
+
+      - name: Validate JavaScript
+        run: |
+          for script in site/assets/*.js; do
+            node --check "$script"
+          done
+
   build-and-deploy:
     # Only runs that report on main get published. A pull request's test run is about the
     # pull request; it must not overwrite the status of the repository.
     if: >-
-      github.event_name != 'workflow_run'
-      || (github.event.workflow_run.head_branch == 'main'
-          && github.event.workflow_run.event != 'pull_request'
-          && github.event.workflow_run.conclusion != 'cancelled'
-          && github.event.workflow_run.conclusion != 'skipped')
+      github.event_name != 'pull_request'
+      && (github.event_name != 'workflow_run'
+          || (github.event.workflow_run.head_branch == 'main'
+              && github.event.workflow_run.event != 'pull_request'
+              && github.event.workflow_run.conclusion != 'cancelled'
+              && github.event.workflow_run.conclusion != 'skipped'))
 
     runs-on: ubuntu-latest