diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 9163aa3..c5deb74 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -10,8 +10,24 @@ on:
       - 'Cargo.lock'
       - 'bundler.toml'
       - 'tools/**'
+      # This workflow validates itself: a broken step, a moved script path or a
+      # wrong runner label then fails loudly on the commit that caused it, rather
+      # than surfacing later against an unrelated source change. Note the limit -
+      # it checks the job body, not the trigger block above. Break `on:` and the
+      # symptom is silence, which looks like success.
+      - '.github/workflows/**'
+  # Mirrors the push filter. Without it a PR touching only the README would run a
+  # full build - the branch filter alone constrains where, not what.
   pull_request:
     branches: [ master ]
+    paths:
+      - 'src/**'
+      - 'xtask/**'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - 'bundler.toml'
+      - 'tools/**'
+      - '.github/workflows/**'
   workflow_dispatch:
 
 # Target the self-hosted Rust/audio runner registered to the `musiikki` org.