diff --git a/.tangled/workflows/test.yml b/.tangled/workflows/test.yml
index c0fdb86..1623af9 100644
--- a/.tangled/workflows/test.yml
+++ b/.tangled/workflows/test.yml
@@ -4,7 +4,7 @@ when:
   - event: ["pull_request"]
     branch: ["main"]
 
-engine: nixery
+engine: tack
 
 tack:
   buildkite:
diff --git a/README.md b/README.md
index 2939a9f..b4fbbb4 100644
--- a/README.md
+++ b/README.md
@@ -24,8 +24,7 @@ when:
   - event: ["pull_request"]
     branch: ["main"]
 
-# this does nothing for Tack but is required by Tangled
-engine: nixery
+engine: tack
 
 tack:
   buildkite:
diff --git a/provider_router.go b/provider_router.go
index 62726dc..3fb0de8 100644
--- a/provider_router.go
+++ b/provider_router.go
@@ -69,6 +69,15 @@ func (r *providerRouter) Spawn(
 		if wf == nil || wf.Name == "" {
 			continue
 		}
+		if wf.Engine != "tack" {
+			r.log.Error("workflow has wrong engine",
+				"err", fmt.Sprintf("expected engine %q, got %q", "tack", wf.Engine),
+				"knot", knot,
+				"pipeline_rkey", pipelineRkey,
+				"workflow", wf.Name,
+			)
+			continue
+		}
 		p, err := r.pick(wf.Raw)
 		if err != nil {
 			r.log.Error("route workflow",
diff --git a/provider_router_test.go b/provider_router_test.go
index 96f1df0..45f0df1 100644
--- a/provider_router_test.go
+++ b/provider_router_test.go
@@ -100,8 +100,8 @@ func TestProviderRouterSpawnRoutesByYAMLKey(t *testing.T) {
 
 	r.Spawn(context.Background(), "knot", "rkey", "did:plc:actor", nil,
 		[]*tangled.Pipeline_Workflow{
-			{Name: "wf-a.yml", Raw: "tack:\n  a: {}\n"},
-			{Name: "wf-b.yml", Raw: "tack:\n  b: {}\n"},
+			{Name: "wf-a.yml", Engine: "tack", Raw: "tack:\n  a: {}\n"},
+			{Name: "wf-b.yml", Engine: "tack", Raw: "tack:\n  b: {}\n"},
 		},
 	)
 
@@ -123,7 +123,7 @@ func TestProviderRouterSpawnFirstYAMLKeyWins(t *testing.T) {
 	// workflow even though both keys are registered.
 	r.Spawn(context.Background(), "knot", "rkey", "did:plc:actor", nil,
 		[]*tangled.Pipeline_Workflow{
-			{Name: "both.yml", Raw: "tack:\n  b: {}\n  a: {}\n"},
+			{Name: "both.yml", Engine: "tack", Raw: "tack:\n  b: {}\n  a: {}\n"},
 		},
 	)
 
@@ -144,13 +144,13 @@ func TestProviderRouterSpawnSkipsUnroutable(t *testing.T) {
 	r.Spawn(context.Background(), "knot", "rkey", "did:plc:actor", nil,
 		[]*tangled.Pipeline_Workflow{
 			// No `tack:` key at all.
-			{Name: "bare.yml", Raw: "steps: []\n"},
+			{Name: "bare.yml", Engine: "tack", Raw: "steps: []\n"},
 			// `tack:` present but with an unknown sub-key.
-			{Name: "unknown.yml", Raw: "tack:\n  nope: {}\n"},
+			{Name: "unknown.yml", Engine: "tack", Raw: "tack:\n  nope: {}\n"},
 			// Empty body — also unroutable.
-			{Name: "empty.yml", Raw: ""},
+			{Name: "empty.yml", Engine: "tack", Raw: ""},
 			// And one good one to prove the loop kept going.
-			{Name: "good.yml", Raw: "tack:\n  a: {}\n"},
+			{Name: "good.yml", Engine: "tack", Raw: "tack:\n  a: {}\n"},
 		},
 	)
 
@@ -162,6 +162,28 @@ func TestProviderRouterSpawnSkipsUnroutable(t *testing.T) {
 	}
 }
 
+// TestProviderRouterSpawnRejectsWrongEngine verifies that workflows
+// without `engine: tack` are skipped.
+func TestProviderRouterSpawnRejectsWrongEngine(t *testing.T) {
+	r, a, b := newRouterTest()
+
+	r.Spawn(context.Background(), "knot", "rkey", "did:plc:actor", nil,
+		[]*tangled.Pipeline_Workflow{
+			{Name: "wrong-engine.yml", Engine: "nixery", Raw: "tack:\n  a: {}\n"},
+			{Name: "empty-engine.yml", Engine: "", Raw: "tack:\n  a: {}\n"},
+			{Name: "correct.yml", Engine: "tack", Raw: "tack:\n  b: {}\n"},
+		},
+	)
+
+	// Only "correct.yml" should reach a provider
+	if got := a.names(); len(got) != 0 {
+		t.Fatalf("provider a should not have been called; got %v", got)
+	}
+	if got, want := b.names(), []string{"correct.yml"}; !equalStrings(got, want) {
+		t.Fatalf("provider b got %v; want %v", got, want)
+	}
+}
+
 // TestProviderRouterLogsFanOut verifies that Logs walks the
 // providers and returns the channel from the first one that doesn't
 // say ErrLogsNotFound. We seed exactly one provider with a real