diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index cd7e83bc..b42cf1ce 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -21,12 +21,34 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
       - uses: DeterminateSystems/nix-installer-action@1d87d45818068401a10cf16bdc5f00b24994a83f
         with:
           determinate: false
+      # A PR from a quest's branch must delete or rewrite its quest. A quest
+      # built from the base checks that before any of the head's code runs on
+      # this runner, so the head cannot weaken the check it is held to.
+      - name: Check out the base
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.base.sha }}
+          persist-credentials: false
+      - name: Build quest from the base
+        if: github.event_name == 'pull_request'
+        run: nix build --out-link "$RUNNER_TEMP/quest-base" .#quest
+      # The full history holds the merge base with the base branch.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      # The checkout is detached, so name the head branch.
+      - name: Check that the PR leaves its quest accurate
+        if: github.event_name == 'pull_request'
+        working-directory: ${{ runner.temp }}
+        env:
+          BASE_REF: ${{ github.base_ref }}
+          HEAD_REF: ${{ github.head_ref }}
+        run: ./quest-base/bin/quest --root "$GITHUB_WORKSPACE" check --base "origin/$BASE_REF" --branch "$HEAD_REF"
       - name: Install dependencies
         run: nix develop --command just install
       # `quest worktree run` owns processes through a systemd user scope, which the tests exercise.
diff --git a/quest/m0/helpers/README.md b/quest/m0/helpers/README.md
index 2c2e2e92..e806f712 100644
--- a/quest/m0/helpers/README.md
+++ b/quest/m0/helpers/README.md
@@ -60,7 +60,6 @@ commands from Sep-Oct. Session counts in each child come from that window.
 - [Complete loop](/quest/m0/helpers/complete-loop.md) - `/quest-complete` re-scans PRs, keeps picks and holds, and counts rounds per PR
 - [Headless agents](/quest/m0/helpers/headless-agents.md) - `/quest-spawn api` launches, resumes, and stops billed agents through one command auto mode allows
 - [Wait gaps](/quest/m0/helpers/wait-gaps.md) - `quest wait` reports every event after its starting point exactly once
-- [Guard in CI](/quest/m0/helpers/ci-guard.md) - pull request CI runs the landed-quest guard
 
 ## Related
 
diff --git a/quest/m0/helpers/ci-guard.md b/quest/m0/helpers/ci-guard.md
deleted file mode 100644
index 69c7ca38..00000000
--- a/quest/m0/helpers/ci-guard.md
+++ /dev/null
@@ -1,19 +0,0 @@
-# [XS] Run the landed-quest guard in CI
-
-## Goal
-
-This repository's pull request CI fails when a PR would leave its quest
-inaccurate, so merges that skip `/quest-merge` are checked too.
-
-## Plan
-
-Decided 2026-10-21 as a follow-up of
-[kixelated/quest#169](https://github.com/kixelated/quest/pull/169):
-
-- Run `quest check --base origin/<base> --branch <head>` (README, "Check a
-  quest's PR") in `.github/workflows/check.yml` on pull requests, using a
-  trusted `quest` built from the base branch, never the head's code or
-  runtime config, as the merge skill requires.
-- Non-quest branches already pass, so no extra filtering is needed.
-- Confirm it passes on a planning PR and fails on a PR that finishes a quest
-  without deleting or updating it.