diff --git a/.github/workflows/run-acceptance-tests.yml b/.github/workflows/run-acceptance-tests.yml
index b18c2ef78..3dc28d58b 100644
--- a/.github/workflows/run-acceptance-tests.yml
+++ b/.github/workflows/run-acceptance-tests.yml
@@ -222,15 +222,42 @@ jobs:
         fields: repo,commit,author,action
         status: ${{ job.status }}
   sentinel:
-    if: github.event_name == 'repository_dispatch' ||
-      github.event.pull_request.head.repo.full_name == github.repository
     name: sentinel
+    # We would like to be able to specify `sentinel` as the only required job for this
+    # workflow. To do that, we need `sentinel` to succeed only when it is safe to
+    # merge and fail in all other cases.
+    #
+    # We can't use the default `if: success()`, since GitHub interprets a skipped job as a
+    # success, and by default a dependee job failing will skip a dependent job. That means
+    # if a test step fails, then it will skip `sentinel` so GitHub will register
+    # `sentinel` as succeeded.
+    #
+    # GitHub documents `jobs.result` as:
+    #
+    #	The result of a job in the reusable workflow. Possible values are success,
+    #	failure, cancelled, or skipped.
+    #
+    # GitHub documents `cancelled()` as:
+    #
+    #	Returns true if the workflow was canceled.
+    #
+    # Combining these terms gives us an intuitive definition of success:
+    #
+    #	We have succeeded when no dependent workflow has failed and the job was
+    #	not cancelled.
+    #
+    if: (github.event_name == 'repository_dispatch' ||
+      github.event.pull_request.head.repo.full_name == github.repository) &&
+      ! cancelled()
     needs:
     - test
     runs-on: ubuntu-latest
     steps:
-    - name: Is workflow a success
-      run: echo yes
+    - name: Workflow is not a success
+      if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped')
+      run: exit 1
+    - name: Workflow is a success
+      run: echo "🎉🎈🎉🎈🎉"
   test:
     if: github.event_name == 'repository_dispatch' ||
       github.event.pull_request.head.repo.full_name == github.repository