diff --git a/.github/workflows/build-setup.yml b/.github/workflows/setup/build-setup.yml
similarity index 82%
rename from .github/workflows/build-setup.yml
rename to .github/workflows/setup/build-setup.yml
index fb0477a..4892ff5 100644
--- a/.github/workflows/build-setup.yml
+++ b/.github/workflows/setup/build-setup.yml
@@ -1,5 +1,6 @@
 # Steps dist inserts into each build job before it installs the apt
-# dependencies from dist-workspace.toml and runs `dist build`.
+# dependencies from dist-workspace.toml and runs `dist build`. Not a workflow:
+# it lives one directory down so that GitHub does not read it as one.
 #
 # dist runs `apt-get install` without `-y`. On GitHub's own runners that is
 # harmless, because their apt is configured to assume yes; inside the
diff --git a/dist-workspace.toml b/dist-workspace.toml
index 209cc10..29d4b3f 100644
--- a/dist-workspace.toml
+++ b/dist-workspace.toml
@@ -25,8 +25,11 @@ features = ["pam"]
 # pull request, which is the release step that can actually break.
 pr-run-mode = "skip"
 # Steps run in each build job before the apt dependencies below are installed:
-# see the file for why.
-github-build-setup = "build-setup.yml"
+# see the file for why. The path is relative to .github/workflows; the file
+# sits in a subdirectory because GitHub reads every YAML file directly under
+# .github/workflows as a workflow, and a bare list of steps is not one -- it
+# showed up as a failing workflow on every push.
+github-build-setup = "setup/build-setup.yml"
 
 # Ship only the multicall binary. `shadow-rs-completions` is a build-time
 # helper behind `required-features = ["completions"]`, so it is not part of a