diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
new file mode 100644
index 0000000..aa14de5
--- /dev/null
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -0,0 +1,15 @@
+<!--
+The TITLE must be a Conventional Commit - `fix: ...`, `feat: ...` - because it becomes the
+squash commit. See CONTRIBUTING.md.
+-->
+
+## What this changes
+
+<!-- One or two sentences. If it follows an AnsibleForms change, link that pull request. -->
+
+## Checklist
+
+- [ ] Branch is named `<type>/<description>` and the title is a Conventional Commit
+- [ ] `gofmt -l .` prints nothing, and `go vet ./...` and `go test ./...` pass
+- [ ] Tried the changed flow with the built binary on a test machine, or the change does not affect it
+- [ ] New or changed texts are in every language under `internal/i18n/locales`
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ebbdb05..505ff57 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,7 +5,8 @@ name: CI
 # on amd64 and arm64. A Dependabot bump of a Go module or an action has to pass it before it
 # is merged.
 #
-# The job name is a required check in the main ruleset: renaming it breaks that rule.
+# The main ruleset requires one check, CI passed, which passes only when every job did: a job
+# added later is covered without changing the ruleset.
 
 on:
   pull_request:
@@ -50,3 +51,20 @@ jobs:
           for arch in amd64 arm64; do
             CGO_ENABLED=0 GOOS=linux GOARCH="$arch" go build -trimpath -o "/tmp/ansibleforms-installer_linux_$arch" .
           done
+
+  # The one check the ruleset requires, so a job added later is covered without
+  # changing the ruleset. This passes only when every job did.
+  passed:
+    name: CI passed
+    if: always()
+    needs: [test]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Every job passed
+        env:
+          RESULTS: ${{ join(needs.*.result, ' ') }}
+        run: |
+          echo "Job results: $RESULTS"
+          for result in $RESULTS; do
+            [ "$result" = "success" ] || { echo "::error::A CI job ended with '$result'."; exit 1; }
+          done
diff --git a/README.md b/README.md
index 48af816..b50733a 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,6 @@
 # AnsibleForms installer
 
+[![CI](https://img.shields.io/github/actions/workflow/status/ansibleforms/installer/ci.yml?branch=main&label=CI)](https://github.com/ansibleforms/installer/actions/workflows/ci.yml)
 [![License](https://img.shields.io/badge/license-GPL--3.0-blue)](LICENSE)
 [![Docs](https://img.shields.io/badge/docs-ansibleforms.com-informational)](https://ansibleforms.com)