diff --git a/.github/workflows/openapi-sync.yml b/.github/workflows/openapi-sync.yml
index 3cdb7d4..f508b83 100644
--- a/.github/workflows/openapi-sync.yml
+++ b/.github/workflows/openapi-sync.yml
@@ -9,8 +9,6 @@ on:
         description: Exact Life-USTC/server commit SHA (defaults to current main)
         required: false
         type: string
-  repository_dispatch:
-    types: [openapi-updated]
 
 permissions:
   contents: write
@@ -29,10 +27,9 @@ jobs:
       - name: Resolve immutable server commit
         id: server
         env:
-          DISPATCH_SHA: ${{ github.event.client_payload.server_sha }}
           INPUT_SHA: ${{ inputs.server_sha }}
         run: |
-          explicit="${INPUT_SHA:-${DISPATCH_SHA:-}}"
+          explicit="${INPUT_SHA:-}"
           if [[ -n "$explicit" ]]; then
             if [[ ! "$explicit" =~ ^[0-9a-f]{40}$ ]]; then
               echo "Explicit server_sha must be an exact 40-character lowercase commit SHA" >&2
@@ -70,8 +67,15 @@ jobs:
 
       - name: Sync contract and generated client
         run: |
-          make sync-openapi OPENAPI_SERVER_DIR=.openapi-server SERVER_COMMIT=${{ steps.server.outputs.sha }}
-          make check-openapi-sync OPENAPI_SERVER_DIR=.openapi-server
+          test "$(git -C .openapi-server rev-parse HEAD)" = "${{ steps.server.outputs.sha }}"
+          if ./scripts/openapi-contract verify >/dev/null 2>&1 \
+            && ./scripts/openapi-contract verify-reachable .openapi-server >/dev/null 2>&1 \
+            && cmp -s .openapi-server/public/openapi.generated.json api/openapi.json; then
+            echo "Server contract is unchanged; preserving the existing provenance pin." >> "$GITHUB_STEP_SUMMARY"
+          else
+            make sync-openapi OPENAPI_SERVER_DIR=.openapi-server SERVER_COMMIT=${{ steps.server.outputs.sha }}
+            make check-openapi-sync OPENAPI_SERVER_DIR=.openapi-server
+          fi
           make generate
 
       - name: Build, test, and vet