diff --git a/scripts/validate-workflow-execution-policies.sh b/scripts/validate-workflow-execution-policies.sh
index a177bddd..ace88679 100755
--- a/scripts/validate-workflow-execution-policies.sh
+++ b/scripts/validate-workflow-execution-policies.sh
@@ -60,7 +60,7 @@ actor_types='["User","Bot","Team","BusinessTeam","EnterpriseTeam","IntegrationIn
 # Policy files the maintainer has approved to be active, by exact file name. Adding a name here is
 # the approval: each activation changes this list in its own reviewed pull request. See the README's
 # "Testing a policy before it blocks".
-approved_active='["restrict-deploy-starters-go-template.json","restrict-deploy-starters-data-product-controller.json"]'
+approved_active='["restrict-deploy-starters-go-template.json","restrict-deploy-starters-data-product-controller.json","restrict-deploy-starters-world-at-ruin.json"]'
 
 failed=0
 for f in "${files[@]}"; do
diff --git a/workflow-execution-policies/restrict-deploy-starters-world-at-ruin.json b/workflow-execution-policies/restrict-deploy-starters-world-at-ruin.json
index 2c553882..a0ad22cb 100644
--- a/workflow-execution-policies/restrict-deploy-starters-world-at-ruin.json
+++ b/workflow-execution-policies/restrict-deploy-starters-world-at-ruin.json
@@ -1,6 +1,6 @@
 {
   "name": "Only portfolio identities may start deploy and publish workflows in world-at-ruin",
-  "enforcement": "disabled",
+  "enforcement": "active",
   "conditions": {
     "repository_name": {
       "include": [