diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 4ceb067e2..d368fc277 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -120,7 +120,7 @@ jobs:
           name: web
 
   docs:
-    if: github.repository != 'mitmproxy/mitmproxy' || github.ref != 'refs/heads/main'
+    if: github.repository != 'mitmproxy/mitmproxy' || github.ref != 'refs/heads/actions-hardening'
     # mirrored below >>>
     runs-on: ubuntu-latest
     steps:
@@ -143,7 +143,7 @@ jobs:
 # so we make sure to really pin everything here.
 
   deploy-docs:
-    if: github.repository == 'mitmproxy/mitmproxy' && github.ref == 'refs/heads/main'
+    if: github.repository == 'mitmproxy/mitmproxy' && github.ref == 'refs/heads/actions-hardening'
     environment: deploy-docs
     # mirrored above >>>
     runs-on: ubuntu-latest
diff --git a/docs/upload-dev.sh b/docs/upload-dev.sh
index a1b544b38..4970254e7 100644
--- a/docs/upload-dev.sh
+++ b/docs/upload-dev.sh
@@ -5,7 +5,7 @@ set -o pipefail
 set -o nounset
 # set -o xtrace
 
-if [[ $GITHUB_REF != "refs/heads/main" ]]; then
+if [[ $GITHUB_REF != "refs/heads/actions-hardening" ]]; then
   echo "Looks like we are not running on CI."
   exit 1
 fi