diff --git a/README.md b/README.md
index f8e94e5..e6ac140 100644
--- a/README.md
+++ b/README.md
@@ -704,6 +704,8 @@ name: Semgrep Scan
 on:
   pull_request:
   workflow_dispatch:
+  push:
+    branches: [main]
 permissions:
   contents: read
 jobs:
diff --git a/tests/test-semgrep-scan.sh b/tests/test-semgrep-scan.sh
index fa3bedf..1b76424 100755
--- a/tests/test-semgrep-scan.sh
+++ b/tests/test-semgrep-scan.sh
@@ -111,5 +111,16 @@ else
   _bad "caller stub names changed"
 fi
 
+# 10. the README setup example has the stub's triggers
+stub_on="$(awk '/^on:$/{f=1} /^permissions:$/{f=0} f && !/^ *#/' "${stub_file}")"
+readme_on="$(awk '/^## `semgrep-scan.yml`$/{m=1} m && /^### Setup$/{s=1}
+  s && /^```yaml$/{y=1; next} y && /^```$/{exit}
+  y && /^on:$/{f=1} y && /^permissions:$/{f=0} f && !/^ *#/' "${readme}")"
+if [[ -n "${stub_on}" && "${stub_on}" == *"push:"* && "${stub_on}" == "${readme_on}" ]]; then
+  _ok "README setup example has the caller stub's triggers"
+else
+  _bad "trigger drift: stub='${stub_on}' README='${readme_on}'"
+fi
+
 echo "${pass} passed, ${fail} failed"
 [[ "${fail}" -eq 0 ]]