diff --git a/.gitea/workflows/gitea-main-ci.yaml b/.gitea/workflows/gitea-main-ci.yaml
index 85f8632..76d2a62 100644
--- a/.gitea/workflows/gitea-main-ci.yaml
+++ b/.gitea/workflows/gitea-main-ci.yaml
@@ -34,6 +34,30 @@ on:
       - "**"      # every branch — feature branches get a branch-name+sha tag
     tags:
       - "v*"      # tag push -> clean semver tag (v1.2.3 -> 1.2.3)
+    # Skip this ~17-min VM build when a push touches ONLY things that are NOT
+    # rootfs/UKI build inputs. The image is built from diskless.pkr.hcl + http/
+    # (ks.cfg) + files/** + scripts/** — those are deliberately NOT listed here,
+    # so they always trigger. Everything below is runtime/serving infra, docs, or
+    # dev tooling that never lands in the rootfs. A commit that also touches a
+    # real build input still builds (paths-ignore only skips when EVERY changed
+    # path matches).
+    paths-ignore:
+      # Serving stack — served at runtime, built by its own image workflows /
+      # the kiosk-app submodule; none of it is baked into the rootfs.
+      - "serving/**"
+      - "serving/kiosk-app"          # the submodule gitlink path (pointer bumps)
+      # Docs / notes / dev tooling — not build inputs.
+      - "docs/**"
+      - "*.md"                       # root README.md, CLAUDE.md, etc.
+      - ".devcontainer/**"
+      - ".gitignore"
+      - ".gitattributes"
+      - "LICENSE"
+      # Sibling image workflows build their OWN images, not the UKI. (Add new
+      # ones here; do NOT add gitea-main-ci.yaml — its edits must still build.)
+      - ".gitea/workflows/ipxe-image.yaml"
+      - ".gitea/workflows/dnsmasq-image.yaml"
+      - ".gitea/workflows/spdk-image.yaml"
 
 # One build per ref at a time; a newer push to the same branch cancels the
 # in-flight build (each build is a ~17-min VM run, so don't stack them).