diff --git a/.github/workflows/ci-analyzer.yml b/.github/workflows/ci-analyzer.yml
index 2bb7a8a..4655c3e 100644
--- a/.github/workflows/ci-analyzer.yml
+++ b/.github/workflows/ci-analyzer.yml
@@ -55,7 +55,6 @@ jobs:
     name: Build & Push Docker
     runs-on: ubuntu-latest
     needs: lint-and-test
-    if: github.ref == 'refs/heads/main'
     permissions:
       contents: read
       packages: write
@@ -64,6 +63,7 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
       - name: Log in to GHCR
+        if: github.ref == 'refs/heads/main'
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
@@ -81,7 +81,7 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           context: services/analyzer
-          push: true
+          push: ${{ github.ref == 'refs/heads/main' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
diff --git a/.github/workflows/ci-api.yml b/.github/workflows/ci-api.yml
index 0aac54a..8f9b228 100644
--- a/.github/workflows/ci-api.yml
+++ b/.github/workflows/ci-api.yml
@@ -48,7 +48,6 @@ jobs:
     name: Build & Push Docker
     runs-on: ubuntu-latest
     needs: lint-and-test
-    if: github.ref == 'refs/heads/main'
     permissions:
       contents: read
       packages: write
@@ -57,6 +56,7 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
       - name: Log in to GHCR
+        if: github.ref == 'refs/heads/main'
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
@@ -74,7 +74,7 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           context: services/api
-          push: true
+          push: ${{ github.ref == 'refs/heads/main' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
diff --git a/.github/workflows/ci-collector.yml b/.github/workflows/ci-collector.yml
index 348f6b9..7879808 100644
--- a/.github/workflows/ci-collector.yml
+++ b/.github/workflows/ci-collector.yml
@@ -55,7 +55,6 @@ jobs:
     name: Build & Push Docker
     runs-on: ubuntu-latest
     needs: lint-and-test
-    if: github.ref == 'refs/heads/main'
     permissions:
       contents: read
       packages: write
@@ -64,6 +63,7 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
       - name: Log in to GHCR
+        if: github.ref == 'refs/heads/main'
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
@@ -81,7 +81,7 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           context: services/collector
-          push: true
+          push: ${{ github.ref == 'refs/heads/main' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
diff --git a/.github/workflows/ci-dashboard.yml b/.github/workflows/ci-dashboard.yml
index 6635c0a..bc22f16 100644
--- a/.github/workflows/ci-dashboard.yml
+++ b/.github/workflows/ci-dashboard.yml
@@ -42,7 +42,6 @@ jobs:
     name: Build & Push Docker
     runs-on: ubuntu-latest
     needs: lint-and-build
-    if: github.ref == 'refs/heads/main'
     permissions:
       contents: read
       packages: write
@@ -51,6 +50,7 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
       - name: Log in to GHCR
+        if: github.ref == 'refs/heads/main'
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
@@ -68,7 +68,7 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           context: dashboard
-          push: true
+          push: ${{ github.ref == 'refs/heads/main' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
diff --git a/.github/workflows/ci-notifier.yml b/.github/workflows/ci-notifier.yml
index 13cdd04..34c8c37 100644
--- a/.github/workflows/ci-notifier.yml
+++ b/.github/workflows/ci-notifier.yml
@@ -51,7 +51,6 @@ jobs:
     name: Build & Push Docker
     runs-on: ubuntu-latest
     needs: lint-and-test
-    if: github.ref == 'refs/heads/main'
     permissions:
       contents: read
       packages: write
@@ -60,6 +59,7 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
       - name: Log in to GHCR
+        if: github.ref == 'refs/heads/main'
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
@@ -77,7 +77,7 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           context: services/notifier
-          push: true
+          push: ${{ github.ref == 'refs/heads/main' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
diff --git a/.github/workflows/ci-subscription.yml b/.github/workflows/ci-subscription.yml
index 9179803..5caac15 100644
--- a/.github/workflows/ci-subscription.yml
+++ b/.github/workflows/ci-subscription.yml
@@ -53,7 +53,6 @@ jobs:
     name: Build & Push Docker
     runs-on: ubuntu-latest
     needs: lint-and-test
-    if: github.ref == 'refs/heads/main'
     permissions:
       contents: read
       packages: write
@@ -62,6 +61,7 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
       - name: Log in to GHCR
+        if: github.ref == 'refs/heads/main'
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
@@ -79,7 +79,7 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           context: services/subscription
-          push: true
+          push: ${{ github.ref == 'refs/heads/main' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 455fed4..9d13bf0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,18 @@ Versions map to GitHub pull requests; the project does not use semver tags yet.
 
 ---
 
+## [0.9.0] - 2026-03-24 - PR #10: Docker build validation on every PR
+
+### Fixed
+
+- All six `build-and-push` CI jobs were gated with
+  `if: github.ref == 'refs/heads/main'`, meaning a broken Dockerfile was only
+  discovered after merge. The job now runs on every push and PR; only the push
+  to GHCR remains conditional on `main`. The GHCR login step is also skipped
+  on PRs so no credentials are required for a build-only run.
+
+---
+
 ## [0.8.0] - 2026-03-23 - PR #8: Fix collector and analyzer Docker builds
 
 ### Fixed
diff --git a/PROGRESS.md b/PROGRESS.md
index 59ffb03..46cf1de 100644
--- a/PROGRESS.md
+++ b/PROGRESS.md
@@ -62,9 +62,8 @@ Kong proxies the public API. OTel Collector forwards traces to Jaeger.
 | CI - e2e | passing | push/PR on `e2e/**` |
 | PR Checks | passing | all PRs (commitlint + markdownlint) |
 
-**Known gap:** Docker `build-and-push` only runs on `main`, not on PRs.
-A failing Dockerfile is only caught after merge. Fix planned: build (no push)
-on PRs too.
+Docker `build-and-push` now runs on every PR (build only) and pushes to GHCR
+only on `main`. A broken Dockerfile will fail the PR before merge.
 
 ---
 
@@ -90,7 +89,7 @@ Items not yet started, ordered roughly by priority.
 
 ### Near-term
 
-- [ ] Build (no push) Docker images on PRs so broken Dockerfiles are caught
+- [x] Build (no push) Docker images on PRs so broken Dockerfiles are caught
       before merge.
 - [ ] Replace the `go get` workaround in Dockerfiles with properly committed
       `go.mod` / `go.sum` files (requires Go installed in the dev environment