diff --git a/.github/workflows/branch-deploy.yml b/.github/workflows/branch-deploy.yml
index bc0afa0..9f2c075 100644
--- a/.github/workflows/branch-deploy.yml
+++ b/.github/workflows/branch-deploy.yml
@@ -26,7 +26,7 @@ jobs:
     steps:
       - name: branch-deploy
         id: branch-deploy
-        uses: github/branch-deploy@v8
+        uses: github/branch-deploy@v9
         with:
           admins: the-hideout/core-contributors
           admins_pat: ${{ secrets.BRANCH_DEPLOY_ADMINS_PAT }}
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index d675e55..4023c5f 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -12,8 +12,23 @@ env:
   WORKING_DIR: "terraform/"
 
 jobs:
+  deployment-check:
+    runs-on: ubuntu-latest
+    outputs: # set outputs for use in downstream jobs
+      continue: ${{ steps.deployment-check.outputs.continue }}
+
+    steps:
+      # https://github.com/github/branch-deploy/blob/d3c24bd92505e623615b75ffdfac5ed5259adbdb/docs/merge-commit-strategy.md
+      - name: deployment check
+        uses: github/branch-deploy@v9
+        id: deployment-check
+        with:
+          merge_deploy_mode: "true"
+          environment: production
+
   deploy:
-    if: github.event_name == 'push'
+    if: ${{ needs.deployment-check.outputs.continue == 'true' && github.event_name == 'push' }}
+    needs: deployment-check
     environment: production
     runs-on: ubuntu-latest
     defaults:
diff --git a/.github/workflows/new-pr.yml b/.github/workflows/new-pr.yml
index f7091f8..2af5436 100644
--- a/.github/workflows/new-pr.yml
+++ b/.github/workflows/new-pr.yml
@@ -18,7 +18,7 @@ jobs:
       # Comment on new PR requests with deployment instructions
       - uses: actions/checkout@v4
       - name: comment
-        uses: GrantBirki/comment@v2.0.8
+        uses: GrantBirki/comment@v2
         continue-on-error: true
         with:
           file: .github/new-pr-comment.md
diff --git a/.github/workflows/unlock-on-merge.yml b/.github/workflows/unlock-on-merge.yml
index 37745a8..1b8e2ab 100644
--- a/.github/workflows/unlock-on-merge.yml
+++ b/.github/workflows/unlock-on-merge.yml
@@ -14,7 +14,7 @@ jobs:
 
     steps:
       - name: unlock on merge
-        uses: github/branch-deploy@v8
+        uses: github/branch-deploy@v9
         id: unlock-on-merge
         with:
           unlock_on_merge_mode: "true" # <-- indicates that this is the "Unlock on Merge Mode" workflow