diff --git a/.github/workflows/README.md b/.github/workflows/README.md
index 8721912..f86e872 100644
--- a/.github/workflows/README.md
+++ b/.github/workflows/README.md
@@ -3,17 +3,16 @@
 ```
 deno lint -> deno test ┐
 check -> wasm -> runtime -> demo
-cli (parallel) ────────┘
 ```
 
 | Workflow | Role |
 |----------|------|
 | `_check.yml` | `cargo shear` + `clippy` (host and wasm targets) |
-| `_cli.yml` | Builds and tests the `cli/` workspace (`cargo build` + `cargo test`); on `main` pushes also publishes the release binary + `install.sh` to GitHub Pages |
 | `_wasm.yml` | Builds and optimizes `compiler_lib.wasm`. On tags, attaches the `.wasm` to the GitHub Release |
 | `_runtime_check.yml` | JS-side gate: `deno lint runtime/` + `deno test runtime/tests/` (Playwright + Chromium driving `createWorker` against the CDN-deployed wasm). Independent branch, runs in parallel with the Rust pipeline; only the CDN upload below blocks on it |
 | `_runtime.yml` | Bundles `runtime/` + `compiler_lib.wasm` and deploys them to Cloudflare Pages |
 | `_demo.yml` | Hashes `compiler_lib.wasm` into `version.json` (cache-busting) and deploys `demo/` to Cloudflare Pages |
+| `cli.yml` | Standalone (not part of the pipeline above): builds and tests `cli/`; on `main` pushes also publishes the release binary + `install.sh` to GitHub Pages |
 
 ## Cloudflare Pages
 
diff --git a/.github/workflows/_cli.yml b/.github/workflows/cli.yml
similarity index 94%
rename from .github/workflows/_cli.yml
rename to .github/workflows/cli.yml
index d92dd74..d355d23 100644
--- a/.github/workflows/_cli.yml
+++ b/.github/workflows/cli.yml
@@ -1,7 +1,13 @@
-name: _CLI
+name: CLI
 
 on:
-  workflow_call:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
 
 jobs:
   build_test:
diff --git a/.github/workflows/pipeline.yml b/.github/workflows/pipeline.yml
index 249a862..53b2192 100644
--- a/.github/workflows/pipeline.yml
+++ b/.github/workflows/pipeline.yml
@@ -14,12 +14,6 @@ jobs:
     uses: ./.github/workflows/_check.yml
     secrets: inherit
 
-  # CLI build + test (separate workspace under cli/); runs in parallel with `check`.
-  cli:
-    name: CLI
-    uses: ./.github/workflows/_cli.yml
-    secrets: inherit
-
   # Build the release WebAssembly artifact.
   wasm:
     name: WebAssembly