diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dcaa87e..5c9efd5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -89,17 +89,26 @@ jobs:
           echo "COM_BFSTOP_ROOT=$RUNNER_TEMP/com_bfstop" >> "$GITHUB_ENV"
       - uses: actions/checkout@v7
 
-      # the component is tested together with the plugin: use its branch of
-      # the same name if there is one (for changes spanning both), else main
+      # use the com_bfstop branch of the same name if there is one and it
+      # has commits main hasn't (for changes spanning both), else main: a
+      # branch which was merged and not deleted is a stale copy of an old main
       - name: Determine com_bfstop branch
         id: com
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: |
           branch="${GITHUB_HEAD_REF:-$GITHUB_REF_NAME}"
-          if git ls-remote --exit-code --heads https://github.com/codeling/com_bfstop.git "$branch" > /dev/null; then
-            echo "ref=$branch" >> "$GITHUB_OUTPUT"
-          else
-            echo "ref=main" >> "$GITHUB_OUTPUT"
+          ref=main
+          ahead=none
+          if [[ "$branch" =~ ^[A-Za-z0-9._/-]+$ ]] \
+            && git ls-remote --exit-code --heads https://github.com/codeling/com_bfstop.git "$branch" > /dev/null; then
+            ahead="$(gh api "repos/codeling/com_bfstop/compare/main...$branch" --jq .ahead_by)"
+            if [ "$ahead" -gt 0 ]; then
+              ref="$branch"
+            fi
           fi
+          echo "ref=$ref" >> "$GITHUB_OUTPUT"
+          echo "Using com_bfstop $ref (a branch '$branch' there is ahead of main by: $ahead)"
       - uses: actions/checkout@v7
         with:
           repository: codeling/com_bfstop
diff --git a/tests/README.md b/tests/README.md
index 2ed19aa..ec8612c 100644
--- a/tests/README.md
+++ b/tests/README.md
@@ -29,6 +29,11 @@ the site only needs to be set up again when the database schema changes.
 GitHub Actions runs everything on each push and pull request, on Joomla 5 and
 6 with MySQL, MariaDB and PostgreSQL, see `.github/workflows/ci.yml`.
 
+Plugin and component are tested together, and each repository's workflow checks
+out the other one: the branch of the same name if that exists **and has commits
+`main` doesn't** (for a change spanning both repositories), else `main`. A
+branch that was merged and not deleted is therefore ignored, not tested against.
+
 ### Joomla versions of the CI matrix
 
 The matrix runs one Joomla version per major version, each with its SHA-256 in