diff --git a/infra/k8s/argo/events/ci-pipeline-sensor.yaml b/infra/k8s/argo/events/ci-pipeline-sensor.yaml
index c01bcf8ea..d51a61d5b 100644
--- a/infra/k8s/argo/events/ci-pipeline-sensor.yaml
+++ b/infra/k8s/argo/events/ci-pipeline-sensor.yaml
@@ -18,17 +18,24 @@ spec:
       eventName: gitlab-push
       filters:
         data:
+          # DISABLED per user directive: pushes must not trigger any compute.
+          # Filter requires a ref value that no real webhook will ever emit,
+          # so the sensor evaluates but always rejects. Ci-pipeline (including
+          # the expensive test-gate) now runs via manual `argo submit` only.
+          #
+          # To re-enable push-triggered CI: change the value back to
+          # "refs/heads/main" AND re-apply the sensor
+          # (`kubectl apply -f infra/k8s/argo/events/ci-pipeline-sensor.yaml`).
           - path: body.ref
             type: string
             value:
-              - "refs/heads/main"
-  # Auto-compile (compile-and-deploy) is available via the manual webhook:
-  #   curl -X POST http://workflow-trigger-eventsource-svc.foxhunt:12001/compile-deploy \
-  #     -H 'Content-Type: application/json' -d '{"commit_sha": "<SHA>"}'
-  # To enable auto-compile on every push to main, add a second trigger here
-  # that submits compile-and-deploy with the same checkout_sha.
-  # Toggle: kubectl -n foxhunt patch configmap auto-compile-config \
-  #   -p '{"data":{"enabled":"true"}}'
+              - "refs/heads/__push_ci_disabled_by_policy__"
+  # Manual triggers still work:
+  #   - ci-pipeline:        argo submit --from=wftmpl/ci-pipeline -p commit-sha=<SHA>
+  #   - compile-and-deploy: curl -X POST http://workflow-trigger-eventsource-svc.foxhunt:12001/compile-deploy \
+  #                           -H 'Content-Type: application/json' -d '{"commit_sha": "<SHA>"}'
+  # The auto-compile-config ConfigMap is a separate toggle for auto-compile on
+  # push to main; leave it at "false" to keep deploy manual as well.
 
   triggers:
     - template: