diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 8fbfdda..d99754e 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -31,3 +31,9 @@ updates:
         patterns: ["*"]
     commit-message:
       prefix: "build(deps)"
+    ignore:
+      # TypeScript 7 is the native-compiler rewrite and breaks `next build`
+      # (verified: the site builds on 5.x, fails on 7.0.2). Migrate to it
+      # deliberately, not via a routine deps bump.
+      - dependency-name: typescript
+        update-types: ["version-update:semver-major"]
diff --git a/.github/workflows/site-ci.yml b/.github/workflows/site-ci.yml
new file mode 100644
index 0000000..c15b7bd
--- /dev/null
+++ b/.github/workflows/site-ci.yml
@@ -0,0 +1,36 @@
+name: Site CI
+
+# Build the website on pull requests that touch it, so a broken build is
+# caught before merge — pages.yml only builds on push to main, which would
+# otherwise be the first time a bad website change fails.
+on:
+  pull_request:
+    paths: ["website/**", ".github/workflows/site-ci.yml"]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: site-ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: website build
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: website
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: website/package-lock.json
+      - run: npm ci
+      # Same base path as the pages.yml deploy build, so the two can't drift.
+      - name: Build static site
+        run: npm run build
+        env:
+          PAGES_BASE_PATH: /tarjan
diff --git a/commitlint.config.mjs b/commitlint.config.mjs
index 64f8c44..35e82e7 100644
--- a/commitlint.config.mjs
+++ b/commitlint.config.mjs
@@ -4,6 +4,11 @@
 // .githooks/commit-msg (enable with `make hooks`).
 export default {
   extends: ["@commitlint/config-conventional"],
+  // Dependabot's generated messages ("build(deps): Bump …") use a capitalized
+  // subject and long metadata lines in the body, neither of which can be
+  // changed via dependabot.yml — exempt them instead of failing every update
+  // PR. The type/scope prefix itself is still set in .github/dependabot.yml.
+  ignores: [(message) => /^(build|ci)\(deps[^)]*\): bump /i.test(message)],
   rules: {
     // Keep in sync with .githooks/commit-msg.
     "header-max-length": [2, "always", 100],