diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 911fb3f..a9326e6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,66 +1,69 @@
-name: CI
-
-on:
-  pull_request:
-    branches: [main, dev]
-  push:
-    branches: [dev]
-  workflow_dispatch:
-
-concurrency:
-  group: ci-${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  build-test:
-    name: Build, test & smoke
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    # dev -> main is a pure promotion of commits already validated by this same
-    # workflow (via the feature-branch PR into dev, or the push-to-dev run below).
-    # Re-running build/test/smoke here would just burn minutes on code we've
-    # already checked. Any other PR into main (e.g. a hotfix branch) still runs.
-    if: >-
-      !(github.event_name == 'pull_request' &&
-        github.event.pull_request.base.ref == 'main' &&
-        github.event.pull_request.head.ref == 'dev')
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install Zig 0.13.0
-        run: |
-          set -euo pipefail
-          curl -fsSL -o /tmp/zig.tar.xz \
-            "https://ziglang.org/download/0.13.0/zig-linux-x86_64-0.13.0.tar.xz"
-          echo "d45312e61ebcc48032b77bc4cf7fd6915c11fa16e4aad116b66c9468211230ea  /tmp/zig.tar.xz" | sha256sum -c -
-          sudo tar -C /usr/local -xf /tmp/zig.tar.xz
-          echo "/usr/local/zig-linux-x86_64-0.13.0" >> "$GITHUB_PATH"
-
-      - name: Build (ReleaseSafe, baseline CPU)
-        run: |
-          zig version
-          zig build -Doptimize=ReleaseSafe -Dcpu=baseline
-
-      - name: Unit + integration tests
-        run: zig build test -Dcpu=baseline
-
-      - name: CLI smoke
-        run: |
-          set -euo pipefail
-          ./zig-out/bin/bedd version
-          ./zig-out/bin/bedd doctor
-          ./zig-out/bin/bedd skills
-          ./zig-out/bin/bedd tinder validate tinder.example.json
-          ./zig-out/bin/bedd strike inbox demo.event echo
-          BEDD_SKILLS_DIR=zig-out/skills ./zig-out/bin/bedd strike inbox demo.event echo_skill
-
-      - name: Local demo (mock bus)
-        run: ./zig-out/bin/bedd demo
-
-      - name: Bench smoke
-        run: ./zig-out/bin/bedd bench --iterations 10 --skills echo,redact --json
+name: CI
+
+on:
+  pull_request:
+    branches: [main, dev]
+    paths-ignore:
+      - '**/*.md'
+      - 'docs/**'
+      - '.gitignore'
+      - 'LICENSE*'
+  workflow_dispatch:
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  build-test:
+    name: Build, test & smoke
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    # dev -> main is a pure promotion of commits already validated by this same
+    # workflow (via the feature-branch PR into dev, or the push-to-dev run below).
+    # Re-running build/test/smoke here would just burn minutes on code we've
+    # already checked. Any other PR into main (e.g. a hotfix branch) still runs.
+    if: >-
+      !(github.event_name == 'pull_request' &&
+        github.event.pull_request.base.ref == 'main' &&
+        github.event.pull_request.head.ref == 'dev')
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install Zig 0.13.0
+        run: |
+          set -euo pipefail
+          curl -fsSL -o /tmp/zig.tar.xz \
+            "https://ziglang.org/download/0.13.0/zig-linux-x86_64-0.13.0.tar.xz"
+          echo "d45312e61ebcc48032b77bc4cf7fd6915c11fa16e4aad116b66c9468211230ea  /tmp/zig.tar.xz" | sha256sum -c -
+          sudo tar -C /usr/local -xf /tmp/zig.tar.xz
+          echo "/usr/local/zig-linux-x86_64-0.13.0" >> "$GITHUB_PATH"
+
+      - name: Build (ReleaseSafe, baseline CPU)
+        run: |
+          zig version
+          zig build -Doptimize=ReleaseSafe -Dcpu=baseline
+
+      - name: Unit + integration tests
+        run: zig build test -Dcpu=baseline
+
+      - name: CLI smoke
+        run: |
+          set -euo pipefail
+          ./zig-out/bin/bedd version
+          ./zig-out/bin/bedd doctor
+          ./zig-out/bin/bedd skills
+          ./zig-out/bin/bedd tinder validate tinder.example.json
+          ./zig-out/bin/bedd strike inbox demo.event echo
+          BEDD_SKILLS_DIR=zig-out/skills ./zig-out/bin/bedd strike inbox demo.event echo_skill
+
+      - name: Local demo (mock bus)
+        run: ./zig-out/bin/bedd demo
+
+      - name: Bench smoke
+        run: ./zig-out/bin/bedd bench --iterations 10 --skills echo,redact --json
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index dba3a05..71335c7 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -1,49 +1,52 @@
-name: CodeQL
-
-on:
-  pull_request:
-    branches: [main, dev]
-  push:
-    branches: [dev]
-  schedule:
-    - cron: "17 7 * * 1"
-  workflow_dispatch:
-
-concurrency:
-  group: codeql-${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  actions: read
-  contents: read
-  security-events: write
-
-jobs:
-  analyze:
-    name: Analyze (actions)
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    # Same reasoning as ci.yml: skip the pure dev -> main promotion, since this
-    # exact code was already scanned on the way into dev. Direct-to-main PRs
-    # (e.g. hotfixes) and the weekly schedule still run.
-    if: >-
-      !(github.event_name == 'pull_request' &&
-        github.event.pull_request.base.ref == 'main' &&
-        github.event.pull_request.head.ref == 'dev')
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
-        with:
-          languages: actions
-          config-file: ./.github/codeql/codeql-config.yml
-
-      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
-        with:
-          category: "/language:actions"
+name: CodeQL
+
+on:
+  pull_request:
+    branches: [main, dev]
+    paths-ignore:
+      - '**/*.md'
+      - 'docs/**'
+      - '.gitignore'
+      - 'LICENSE*'
+  schedule:
+    - cron: "17 7 * * 1"
+  workflow_dispatch:
+
+concurrency:
+  group: codeql-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze (actions)
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    # Same reasoning as ci.yml: skip the pure dev -> main promotion, since this
+    # exact code was already scanned on the way into dev. Direct-to-main PRs
+    # (e.g. hotfixes) and the weekly schedule still run.
+    if: >-
+      !(github.event_name == 'pull_request' &&
+        github.event.pull_request.base.ref == 'main' &&
+        github.event.pull_request.head.ref == 'dev')
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: actions
+          config-file: ./.github/codeql/codeql-config.yml
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:actions"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3569305..bf741b8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -12,8 +12,7 @@ on:
 
 concurrency:
   group: release-${{ github.workflow }}
-  cancel-in-progress: false
-
+  cancel-in-progress: true
 permissions:
   contents: write
   packages: write