diff --git a/.gitea/workflows/container.yml b/.gitea/workflows/container.yml
index 53d4e17..1537761 100644
--- a/.gitea/workflows/container.yml
+++ b/.gitea/workflows/container.yml
@@ -149,7 +149,7 @@ jobs:
           docker push "${IMAGE}:latest"
 
       - name: Publish Helm chart
-        if: gitea.ref == 'refs/heads/main'
+        if: gitea.event_name == 'push' && gitea.ref == 'refs/heads/main'
         env:
           COMMIT_SHA: ${{ gitea.sha }}
           PACKAGE_USERNAME: ${{ secrets.PACKAGE_USERNAME }}
@@ -171,8 +171,16 @@ jobs:
             --upload-file "${chart_file}" \
             https://code.brunner.ninja/api/packages/feedc0de/helm/api/charts
 
+      - name: Check that this is still current main
+        if: gitea.event_name == 'push' && gitea.ref == 'refs/heads/main'
+        env:
+          COMMIT_SHA: ${{ gitea.sha }}
+        run: |
+          git fetch --no-tags origin main
+          test "$(git rev-parse FETCH_HEAD)" = "${COMMIT_SHA}"
+
       - name: Check out GitOps repository
-        if: gitea.ref == 'refs/heads/main'
+        if: gitea.event_name == 'push' && gitea.ref == 'refs/heads/main'
         uses: actions/checkout@v4
         with:
           repository: ${{ env.GITOPS_REPOSITORY }}
@@ -181,7 +189,7 @@ jobs:
           path: homelab-gitops
 
       - name: Promote the exact chart to every homepage application
-        if: gitea.ref == 'refs/heads/main'
+        if: gitea.event_name == 'push' && gitea.ref == 'refs/heads/main'
         working-directory: homelab-gitops
         run: |
           set -euo pipefail
@@ -189,10 +197,20 @@ jobs:
             brgkepler-com brunner-ninja gschissenes-equipment \
             immich-crack pfostendynamics-com watschn-studio; do
             ./scripts/update-chart-version.sh "${application}" "${CHART_VERSION}"
-            git add "bootstrap/${application}.yaml"
+          git add "bootstrap/${application}.yaml"
           done
           git config user.name "feedc0de"
           git config user.email "feedc0de@users.noreply.code.brunner.ninja"
           if git diff --cached --quiet; then exit 0; fi
           git commit -m "Deploy php-homepage chart ${CHART_VERSION}"
-          git push origin HEAD:main
+          for attempt in 1 2 3; do
+            if git push origin HEAD:main; then
+              exit 0
+            fi
+            if [ "${attempt}" = 3 ]; then
+              echo "GitOps promotion failed after three attempts" >&2
+              exit 1
+            fi
+            git fetch origin main
+            git rebase origin/main
+          done