diff --git a/.github/workflows/workshop.yml b/.github/workflows/workshop.yml
index cdd36a4..09d335a 100644
--- a/.github/workflows/workshop.yml
+++ b/.github/workflows/workshop.yml
@@ -1,17 +1,41 @@
 name: Workshop
 
-# dev-build-workshop-v1 deploys dev; build-workshop-v1 deploys production.
+# DISABLED. Workshop hosting moved to labs.demohouse.cloud, which the WorkshopHouse
+# repository builds and deploys from its own ci.yml and release.yml. That pipeline runs
+# the same gates this one did -- check-docs.sh, check-windows.ps1, and the build_workshop
+# backend and loadgen tests -- against its own copy of workshops/, so none of the work
+# below needs to run here any more. Every job is pinned off with `if: false`.
+#
+# The `pull_request` trigger is deliberately kept, and it is the one thing here that must
+# not be removed casually. `Workshop CI` -- the name of the verify job -- is a *required*
+# status check for `main`, configured in repository rules rather than in this file. Delete
+# the trigger and the check never reports, so every pull request into `main` sits forever
+# on "1 expected check" and cannot merge. Keeping the trigger while skipping the job makes
+# the check report as Skipped, which GitHub accepts in place of a success. That is what
+# unblocks merges at no cost, and it is why this file still runs at all.
+#
+# To finish retiring this pipeline: drop `Workshop CI` from the required checks for `main`
+# (Settings -> Rules), then delete the `pull_request` trigger here too and let the
+# workflow be dispatch-only. Requires admin on the repository.
+#
+# The deploy job is pinned off for a second, independent reason: both hosts it targeted,
+# workshop.demohouse.cloud and dev-workshop.demohouse.cloud, now return 404. Re-enabling
+# it means repointing it at whatever should serve the site -- not just flipping the `if`.
+#
+# Kept rather than deleted so the retired pipeline stays readable next to its replacement.
+# The `push` trigger, which is what actually deployed, was:
+#
+#   push:
+#     branches: [dev-build-workshop-v1, build-workshop-v1]
+#     paths:
+#       - "workshops/build_workshop/**"
+#       - ".github/workflows/workshop.yml"
 
 on:
+  # Kept only so the required `Workshop CI` check still reports; see above. No push
+  # trigger, so nothing deploys.
   pull_request:
-    # Keep the required workshop check available on the existing protected repo
-    # branches, but only the dedicated workshop branches deploy on push.
     branches: [dev, main, dev-build-workshop-v1, build-workshop-v1]
-  push:
-    branches: [dev-build-workshop-v1, build-workshop-v1]
-    paths:
-      - "workshops/build_workshop/**"
-      - ".github/workflows/workshop.yml"
   workflow_dispatch: {}
 
 concurrency:
@@ -21,6 +45,11 @@ concurrency:
 jobs:
   verify:
     name: Workshop CI
+    # Never on a pull request -- WorkshopHouse's ci.yml runs these same gates now. Skipping
+    # is what makes the required `Workshop CI` check report as Skipped instead of hanging;
+    # see the note at the top of this file. Still runs on a manual `workflow_dispatch`, so
+    # the steps below stay usable for spot-checking this repo's copy of workshops/ by hand.
+    if: github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     defaults:
       run:
@@ -74,10 +103,16 @@ jobs:
 
   deploy:
     name: Deploy workshop
-    if: >-
-      (github.event_name == 'push' || github.event_name == 'workflow_dispatch') &&
-      (github.ref_name == 'dev-build-workshop-v1' ||
-       github.ref_name == 'build-workshop-v1')
+    # Pinned off. Both targets return 404 -- the site is served from
+    # labs.demohouse.cloud by the WorkshopHouse pipeline now. Left in place as the record
+    # of how the old host was built and released; see the note at the top of this file
+    # before re-enabling. The original condition was:
+    #
+    #   if: >-
+    #     (github.event_name == 'push' || github.event_name == 'workflow_dispatch') &&
+    #     (github.ref_name == 'dev-build-workshop-v1' ||
+    #      github.ref_name == 'build-workshop-v1')
+    if: false
     needs: verify
     runs-on: ubuntu-latest
     timeout-minutes: 30