diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml
index 4523c3c..fb8bb24 100644
--- a/.github/workflows/workflow-linter.yml
+++ b/.github/workflows/workflow-linter.yml
@@ -8,6 +8,10 @@ name: Workflow Security Linter
 
 on:
   push:
+    # A PR push already runs this through pull_request; push runs only on
+    # main, so each PR push is linted once and main is still checked after merge.
+    branches:
+      - main
     paths:
       - '.github/workflows/**'
   pull_request:
@@ -38,13 +42,15 @@ jobs:
           failed=0
           for file in .github/workflows/*.yml .github/workflows/*.yaml; do
             [ -f "$file" ] || continue
-            if ! head -1 "$file" | grep -q "^# SPDX-License-Identifier:"; then
+            # actions-lock may prepend its own comment. Require the licence
+            # in the leading comment block, before the workflow body.
+            if ! awk '/^# SPDX-License-Identifier:/ { found=1 } /^[^#[:space:]]/ { exit } END { exit !found }' "$file"; then
               echo "ERROR: $file missing SPDX header"
               failed=1
             fi
           done
           if [ $failed -eq 1 ]; then
-            echo "Add '# SPDX-License-Identifier: MPL-2.0' as first line"
+            echo "Add '# SPDX-License-Identifier: MPL-2.0' to the leading comment block"
             exit 1
           fi
           echo "All workflows have SPDX headers"