diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 47a9f6757..22fb20e93 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -12,6 +12,14 @@ on:
   pull_request:
     branches:
       - main
+    # Docs edits can't break an image build, so docs-only PRs skip it. One edge:
+    # deploy/sparc-service/Dockerfile COPYs that dir's README (pyproject metadata),
+    # so deleting it is a docs-only change that fails the build — caught by the
+    # push run on main, not the PR.
+    # Footgun: a filtered-out run reports "Expected" forever if this workflow is
+    # ever added to branch protection as a required check.
+    paths-ignore:
+      - "**.md"
   # Allow manual trigger
   workflow_dispatch:
 
diff --git a/.github/workflows/security-scans.yaml b/.github/workflows/security-scans.yaml
index 5d9ef8c13..70bc37f24 100644
--- a/.github/workflows/security-scans.yaml
+++ b/.github/workflows/security-scans.yaml
@@ -15,6 +15,11 @@ name: Security Scans
 on:
   pull_request:
     branches: [main]
+    # Markdown cannot trip CodeQL, Trivy or Hadolint; docs-only PRs skip them.
+    # Footgun: a filtered-out run reports "Expected" forever if this workflow is
+    # ever added to branch protection as a required check.
+    paths-ignore:
+      - "**.md"
 
 permissions: {}