diff --git a/.ado/publish.yml b/.ado/publish.yml
index 6d331237..255a51ef 100644
--- a/.ado/publish.yml
+++ b/.ado/publish.yml
@@ -7,9 +7,27 @@
 # Name of the run. It is overridden below  with the version of published binaries.
 name: 0.0.$(Date:yyMM.d)$(Rev:rrr)
 
-# This script must never be triggered from YAML settings for security reasons.
+# Triggers are defined here, not in the ADO pipeline UI. This pipeline signs and
+# publishes packages, so it runs only for pushes to main and never for pull
+# requests; PR validation runs in GitHub Actions.
 pr: none
-trigger: none
+trigger:
+  batch: false
+  branches:
+    include:
+    - main
+
+# Monthly keep-alive run so ADO does not disable the pipeline for inactivity.
+# It is not used for real releases and its time is not significant. It also
+# starts release.yml, whose ADO feed jobs fail on the already-published version;
+# that is expected and keeps the release pipeline active too.
+schedules:
+- cron: '0 9 1 * *'
+  displayName: Monthly keep-alive
+  branches:
+    include:
+    - main
+  always: true
 
 parameters:
   # Matrix with target build platforms.
diff --git a/.ado/release.yml b/.ado/release.yml
index 52f8a361..46db6945 100644
--- a/.ado/release.yml
+++ b/.ado/release.yml
@@ -5,7 +5,10 @@
 # to public ADO feeds and to npmjs.com and Nuget.org feeds.
 #
 
+# Runs only when microsoft.node-api-dotnet.ci completes on main (see resources
+# below); triggers are defined here, not in the ADO pipeline UI.
 trigger: none
+pr: none
 name: $(Date:yyyyMMdd).$(Rev:r)
 
 resources: