diff --git a/.github/workflows/mkdocs-pages.yaml b/.github/workflows/mkdocs-pages.yaml
index a6fda5c3..99d6e804 100644
--- a/.github/workflows/mkdocs-pages.yaml
+++ b/.github/workflows/mkdocs-pages.yaml
@@ -12,7 +12,7 @@ jobs:
 
       # Install Python
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
         with:
           python-version: 3.x
 
diff --git a/.github/workflows/summary.yaml b/.github/workflows/summary.yaml
new file mode 100644
index 00000000..a80c570e
--- /dev/null
+++ b/.github/workflows/summary.yaml
@@ -0,0 +1,8 @@
+name: summary
+on:
+  pull_request:
+jobs:
+  enforce:
+    uses: ./.github/workflows/wait-for-status-checks.yaml
+    permissions:
+      checks: read
diff --git a/.github/workflows/wait-for-status-checks.yaml b/.github/workflows/wait-for-status-checks.yaml
new file mode 100644
index 00000000..8f9fdd1b
--- /dev/null
+++ b/.github/workflows/wait-for-status-checks.yaml
@@ -0,0 +1,16 @@
+name: wait-for-status-checks
+on:
+  workflow_call:
+jobs:
+  status-checks:
+    runs-on: [self-hosted, Linux, X64]
+    permissions:
+      checks: read
+    steps:
+      - name: GitHub Checks
+        uses: poseidon/wait-for-status-checks@5fc55bcf5e80b8beab24f45ec6ed96b133d89e42 # v0.4.1
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          # wait-for-status-checks ignores it's own check name, but it does
+          # not know the full name when used inside a reusable workflow
+          ignore: "enforce / status-checks"