diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000000..06f28fccb2
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,3 @@
+# Workflow files gate the human-authors policy. A PR that edits them needs a
+# code-owner review, so the gate cannot be removed by a PR nobody reads.
+/.github/workflows/ @Hugo0