diff --git a/.forgejo/workflows/delta-gate.yml b/.forgejo/workflows/delta-gate.yml
index f9209e39..c320594e 100644
--- a/.forgejo/workflows/delta-gate.yml
+++ b/.forgejo/workflows/delta-gate.yml
@@ -27,6 +27,12 @@ on:
         description: 'Control sha to diff against'
         required: true
         type: string
+  # workflow_dispatch needs Actions-unit write on the dispatching credential;
+  # push does not (it runs from the pushed ref's own tree), so a plain push
+  # to a release or CI branch is the fallback trigger while that grant is
+  # outstanding — see the ref-resolution step below for what it gates against.
+  push:
+    branches: ['rel/**', 'ci/**']
 
 concurrency:
   group: delta-gate
@@ -38,6 +44,21 @@ jobs:
     runs-on: gate-functional
     timeout-minutes: 120
     steps:
+      - name: Resolve candidate/control refs
+        id: refs
+        run: |
+          candidate="${{ github.event.inputs.candidate }}"
+          control="${{ github.event.inputs.control }}"
+          # workflow_dispatch supplies both explicitly; a push event carries
+          # neither — fall back to the pushed commit as candidate and the
+          # last released, known-good tip (10.4.9) as control, so a plain
+          # push still produces a meaningful gate instead of an empty ref.
+          if [ -z "$candidate" ]; then candidate="${{ github.sha }}"; fi
+          if [ -z "$control" ]; then control="eec90bdd"; fi
+          echo "candidate=$candidate" >> "$GITHUB_OUTPUT"
+          echo "control=$control" >> "$GITHUB_OUTPUT"
+          echo "Resolved (trigger=${{ github.event_name }}): candidate=$candidate control=$control"
+
       - name: Clean any residue from a prior run
         run: rm -rf "ob-cand-${{ github.run_id }}" "ob-ctrl-${{ github.run_id }}" "/tmp/ob-${{ github.run_id }}-"*
 
@@ -47,7 +68,7 @@ jobs:
           set -o pipefail
           git clone --quiet "https://source.soulcraft.com/soulcraftlabs/open-brainy.git" "ob-cand-${{ github.run_id }}"
           cd "ob-cand-${{ github.run_id }}"
-          git checkout --quiet "${{ github.event.inputs.candidate }}"
+          git checkout --quiet "${{ steps.refs.outputs.candidate }}"
           git log --oneline -1
           bun install
           rc=0
@@ -63,7 +84,7 @@ jobs:
           set -o pipefail
           git clone --quiet "https://source.soulcraft.com/soulcraftlabs/open-brainy.git" "ob-ctrl-${{ github.run_id }}"
           cd "ob-ctrl-${{ github.run_id }}"
-          git checkout --quiet "${{ github.event.inputs.control }}"
+          git checkout --quiet "${{ steps.refs.outputs.control }}"
           git log --oneline -1
           bun install
           rc=0