diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index ccce603..5162c99 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -23,6 +23,10 @@ concurrency:
   group: jasp-build
   cancel-in-progress: false
 
+# Nothing leaves the runner unless the repo variable PUBLISH is 'true'. Without
+# it a run builds, verifies and generates the PKGBUILD, and leaves the tarball
+# in ${WORK_DIR}/out for inspection: a dry run that cannot touch the tarball
+# host, state.json or the AUR.
 env:
   AUR_MAINTAINER: ${{ vars.AUR_MAINTAINER }}
   TARBALL_HOST: ${{ vars.TARBALL_HOST }}
@@ -114,6 +118,7 @@ jobs:
       # file, so publishing the package before the tarball exists would leave
       # users with a 404.
       - name: Publish tarball to asger.weirsoe.dk
+        if: vars.PUBLISH == 'true'
         env:
           TARBALL_SSH_KEY: ${{ secrets.TARBALL_SSH_KEY }}
         run: |
@@ -121,6 +126,7 @@ jobs:
           bash scripts/publish-tarball.sh "${WORK_DIR}/out/${ASSET}"
 
       - name: Verify the published URL actually serves the tarball
+        if: vars.PUBLISH == 'true'
         run: |
           URL="$(python3 -c 'import json;print(json.load(open("release-meta.json"))["download_url"])')"
           WANT="$(python3 -c 'import json;print(json.load(open("release-meta.json"))["sha256"])')"
@@ -137,6 +143,7 @@ jobs:
       # Only the PKGBUILD and metadata cross the job boundary — the tarball
       # itself already lives on GitHub Releases.
       - name: Hand PKGBUILD to the AUR job
+        if: vars.PUBLISH == 'true'
         uses: actions/upload-artifact@v3
         with:
           name: aur-package
@@ -145,6 +152,7 @@ jobs:
             release-meta.json
 
       - name: Record built state
+        if: vars.PUBLISH == 'true'
         env:
           STATE_PUSH_TOKEN: ${{ secrets.STATE_PUSH_TOKEN }}
         run: bash scripts/record-state.sh
@@ -157,6 +165,7 @@ jobs:
 
   aur:
     needs: [check, build]
+    if: vars.PUBLISH == 'true'
     runs-on: ubuntu-latest
     container:
       image: archlinux:base-devel
diff --git a/README.md b/README.md
index e809391..3239c45 100644
--- a/README.md
+++ b/README.md
@@ -99,6 +99,7 @@ Set these in the Gitea repo before the first run.
 | `TARBALL_HOST` | `192.168.10.148` | CT148, where tarballs are uploaded |
 | `TARBALL_PATH` | `/srv/tarballz` | Directory on that host |
 | `TARBALL_BASE_URL` | `https://asger.weirsoe.dk/tarballz` | Public URL the PKGBUILD downloads from |
+| `PUBLISH` | `true` | Master switch. Unless it is `true`, a run only builds and verifies, leaving the tarball in `/srv/jasp-build/out`: no upload, no `state.json` commit, no AUR push. |
 
 **Secrets** (Settings → Actions → Secrets):