diff --git a/.github/workflows/plugin-registry-index.yml b/.github/workflows/plugin-registry-index.yml
index 91015a976f..0b16433cdc 100644
--- a/.github/workflows/plugin-registry-index.yml
+++ b/.github/workflows/plugin-registry-index.yml
@@ -12,8 +12,8 @@ on:
     paths:
       - "plugin-registry/**"
       - ".github/workflows/plugin-registry-index.yml"
-  # Validate registry edits before merge (build + test run; the Pages deploy
-  # steps below are gated to non-PR events, so a PR never deploys).
+  # Validate registry edits before merge (the build job runs; the separate
+  # deploy job is gated to non-PR events, so a PR never deploys to Pages).
   pull_request:
     paths:
       - "plugin-registry/**"
@@ -39,12 +39,13 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  build-and-deploy:
-    name: Build index.json and deploy to Pages
+  # Build the catalog and, on non-PR events, stage it as a Pages artifact.
+  # Kept free of the `github-pages` environment so it runs on PRs — a job that
+  # binds that environment is checked against its protection rules even when its
+  # deploy steps are skipped, which fails every PR that touches plugin-registry/.
+  build:
+    name: Build index.json
     runs-on: ubuntu-latest
-    environment:
-      name: github-pages
-      url: ${{ steps.deploy.outputs.page_url }}
     steps:
       - name: Checkout code
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
@@ -85,7 +86,18 @@ jobs:
         with:
           path: _site
 
+  # Deploy the staged artifact to GitHub Pages. Separate job so the
+  # `github-pages` environment (and its protection rules) is only ever
+  # evaluated on non-PR events.
+  deploy:
+    name: Deploy to Pages
+    if: github.event_name != 'pull_request'
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deploy.outputs.page_url }}
+    steps:
       - name: Deploy to GitHub Pages
         id: deploy
-        if: github.event_name != 'pull_request'
         uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4