diff --git a/.github/workflows/disable-auto-merge-on-push.yml b/.github/workflows/disable-auto-merge-on-push.yml
new file mode 100644
index 0000000..312128e
--- /dev/null
+++ b/.github/workflows/disable-auto-merge-on-push.yml
@@ -0,0 +1,53 @@
+name: Disable auto-merge on push
+
+# Reusable guard against the "I enabled auto-merge then pushed more
+# commits" race. Background: on 2026-04-27, PR #2174 in molecule-core
+# auto-merged with only the first commit because the second commit
+# was pushed AFTER the merge queue had already locked the PR's SHA.
+# The second commit ended up orphaned on a merged-and-deleted branch.
+#
+# Mechanism: on every `pull_request: synchronize` event (= new commit
+# pushed to an open PR), check if auto-merge is enabled. If yes,
+# disable it and post a comment. This forces the operator to
+# re-engage `gh pr merge --auto` after the new push, with the
+# re-engagement acting as the verification step.
+#
+# Call from each repo's .github/workflows/ via a thin wrapper:
+#
+#   name: pr-guards
+#   on:
+#     pull_request:
+#       types: [synchronize]
+#   permissions:
+#     pull-requests: write
+#   jobs:
+#     disable-auto-merge-on-push:
+#       uses: Molecule-AI/molecule-ci/.github/workflows/disable-auto-merge-on-push.yml@main
+#
+# False-positive behavior: if a CI bot pushes (e.g. dependency-update
+# rebase, secret rotation), this also disables auto-merge for that
+# PR. That's acceptable — the operator who originally enabled
+# auto-merge gets notified and re-engages, which is exactly the
+# verify-after-machine-edits behavior we want.
+
+on:
+  workflow_call:
+
+jobs:
+  guard:
+    name: Disable auto-merge on push
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.auto_merge != null
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Disable auto-merge
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR: ${{ github.event.pull_request.number }}
+          REPO: ${{ github.repository }}
+          NEW_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set -eu
+          gh pr merge "$PR" --disable-auto -R "$REPO" || true
+          gh pr comment "$PR" -R "$REPO" --body "🔒 Auto-merge disabled — new commit (\`${NEW_SHA:0:7}\`) pushed after auto-merge was enabled. The merge queue locks SHAs at entry, so subsequent pushes can race. Verify the new commit and re-enable with \`gh pr merge --auto\`."