diff --git a/.github/workflows/ci-orchestrator.yml b/.github/workflows/ci-orchestrator.yml
index 5d34c3385b..0f29f8d4d1 100644
--- a/.github/workflows/ci-orchestrator.yml
+++ b/.github/workflows/ci-orchestrator.yml
@@ -293,6 +293,11 @@ jobs:
   done:
     name: 🏁 Finish pipeline
     needs:
+      - wait-fork-prereq-run
+      - fork-prereqs-ready
+      - build-ci-images
+      - images-mirror-missing
+      - test-dns
       - test-install-make
       - test-install-pkgmgr
       - test-deploy-single-node-priority
diff --git a/scripts/github/resolve/effective_whitelist.sh b/scripts/github/resolve/effective_whitelist.sh
index be445b3c55..256481238f 100755
--- a/scripts/github/resolve/effective_whitelist.sh
+++ b/scripts/github/resolve/effective_whitelist.sh
@@ -38,6 +38,15 @@ fi
 shopt -u nocasematch
 
 if [[ -n "${input_trimmed}" ]]; then
+	unknown=()
+	for role in ${input}; do
+		[[ -d "roles/${role}" ]] || unknown+=("${role}")
+	done
+	if ((${#unknown[@]})); then
+		echo "[ERROR] Unknown role id(s) in the caller-supplied whitelist: ${unknown[*]}" >&2
+		echo "[ERROR] They match no directory under roles/, so they would be dropped silently and never deployed." >&2
+		exit 1
+	fi
 	printf 'whitelist=%s\n' "${input}" >>"${GITHUB_OUTPUT}"
 	echo "Using caller-supplied whitelist: ${input}"
 	exit 0