diff --git a/.github/workflows/packaging-lint.yml b/.github/workflows/packaging-lint.yml
index bc0248fd20..432ee63008 100644
--- a/.github/workflows/packaging-lint.yml
+++ b/.github/workflows/packaging-lint.yml
@@ -6,8 +6,8 @@ on:
   push:
     branches: [main, release]
     paths: [".github/workflows/**", "packaging/**", "assets/app-icon/**"]
+  # No path filter: main requires these checks, so a PR they skip could never merge.
   pull_request:
-    paths: [".github/workflows/**", "packaging/**", "assets/app-icon/**"]
   workflow_dispatch:
 
 permissions:
diff --git a/docs/releasing.md b/docs/releasing.md
index 3b0aaab2ee..b57eb58b07 100644
--- a/docs/releasing.md
+++ b/docs/releasing.md
@@ -241,7 +241,7 @@ unsigned and the run shows a warning.
 
 ## Checks
 
-`.github/workflows/packaging-lint.yml` runs on changes to `packaging/` and the workflows: actionlint, shellcheck,
+`.github/workflows/packaging-lint.yml` runs on every pull request, and on pushes that change `packaging/`, `assets/app-icon/` or the workflows: actionlint, shellcheck,
 a PowerShell parse, xmllint (WiX, plist, MIME), `desktop-file-validate`, `appstreamcli validate`, and
 the MSI icon-id check. The FreeBSD and Windows ARM64 workflows also exercise their packaging before a
 release does.