diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml
deleted file mode 100644
index 2d10dc59fb34..000000000000
--- a/.github/workflows/dco.yml
+++ /dev/null
@@ -1,21 +0,0 @@
-name: DCO
-
-# The probot DCO app validates sign-off on the pull_request event but does not
-# run on merge_group, so the required "DCO" check would be absent on the merge
-# queue SHA and the queue would stall. This stub posts the "DCO" check on
-# merge_group; sign-off was already enforced by the app before the PR enqueued.
-# The required check is matched by name ("Any source"), so the app satisfies it
-# on the PR and this stub satisfies it in the queue.
-
-on:
-  merge_group:
-
-permissions:
-  contents: read
-
-jobs:
-  DCO:
-    name: DCO
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo "Sign-off enforced by the DCO app on the pull request."
diff --git a/docs/oss/ci-pipeline.md b/docs/oss/ci-pipeline.md
index 6f6eecdf6abd..95c2d877df24 100644
--- a/docs/oss/ci-pipeline.md
+++ b/docs/oss/ci-pipeline.md
@@ -4,7 +4,7 @@ This page documents how the pull-request CI pipeline ([`.github/workflows/ci.yml
 
 ## What runs on a PR
 
-`ci.yml` reports stable verification contexts including `Build`, `Type Check`, `Lint`, `Test`, `E2E Tests`, and `Integration Tests`; a small `Detect inert diff` job classifies the diff (below). Four non-required `Package Tests` shards upload native coverage blobs, `Coverage` merges and gates them while `Test Examples` runs concurrently, and a lightweight final `Test` fan-in preserves the required check name. A separate `DCO` check and the preview-publish workflow also run. `main` is governed by a repository ruleset that requires the verification contexts plus `DCO` and uses the strict "branch must be up to date" policy. Two consequences drive the whole design:
+`ci.yml` reports stable verification contexts including `Build`, `Type Check`, `Lint`, `Test`, `E2E Tests`, and `Integration Tests`; a small `Detect inert diff` job classifies the diff (below). Four non-required `Package Tests` shards upload native coverage blobs, `Coverage` merges and gates them while `Test Examples` runs concurrently, and a lightweight final `Test` fan-in preserves the required check name. The [DCO app](https://github.com/apps/dco) posts a separate `DCO` check on each PR and each merge-queue commit, and the preview-publish workflow also runs. `main` is governed by a repository ruleset that requires the verification contexts plus `DCO` and uses the strict "branch must be up to date" policy. Two consequences drive the whole design:
 
 - A required status check that never reports its result **wedges the merge**. So a job that is required can never be skipped at the job level — it must always launch and report.
 - The ruleset is a fixed constraint. The pipeline is designed *around* it; CI changes never edit the ruleset or the set of required check names.