diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0f1d533..4de0fc2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -97,3 +97,20 @@ jobs:
         run: |
           go install golang.org/x/vuln/cmd/govulncheck@latest
           govulncheck ./...
+
+  ci:
+    # The context master-rule requires: it reports on every run and fails when a job above failed or was
+    # cancelled. A skipped job counts as passed.
+    if: always()
+    needs: [test, govulncheck]
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Every job above succeeded or was skipped
+        env:
+          RESULTS: ${{ join(needs.*.result, ' ') }}
+        run: |
+          echo "needs: $RESULTS"
+          for result in $RESULTS; do
+            case "$result" in failure|cancelled) exit 1 ;; esac
+          done