diff --git a/.github/workflows/cultmesh-portability.yml b/.github/workflows/cultmesh-portability.yml
index 1a838e94..959171ce 100644
--- a/.github/workflows/cultmesh-portability.yml
+++ b/.github/workflows/cultmesh-portability.yml
@@ -1,11 +1,18 @@
 name: CultMesh portability and performance
 
+# The forge runs one job at a time and this workflow holds the slot 14 to 30 minutes, so it runs once per change:
+# on the pull request (never again on the push that merges it; a break that merges from a stale base waits for the
+# schedule), skipped for design-note-only changes, and on a
+# daily schedule so main is still exercised when nobody opens a pull request.
 on:
-  push:
-    branches:
-      - main
-      - "codex/**"
   pull_request:
+    paths-ignore:
+      # Not `**/*.md` or `docs/**`: docs/start/README.md is read by the first-call tests of every runtime.
+      - "docs/*.md"
+      - "research/**"
+      - ".voidbot/**"
+  schedule:
+    - cron: "17 3 * * *"
   workflow_dispatch:
 
 concurrency:
diff --git a/.github/workflows/quic-native.yml b/.github/workflows/quic-native.yml
index 6a4c9cdf..8f1fed18 100644
--- a/.github/workflows/quic-native.yml
+++ b/.github/workflows/quic-native.yml
@@ -9,13 +9,21 @@ name: CultMesh QUIC native
 # from the pinned debian:13 container below, never from a local or Yggdrasil
 # build.
 
+# Only a change to the committed binaries, their manifest or this workflow can change what verify-committed checks,
+# so a branch push or pull request runs it for those paths alone; a tag always runs it.
 on:
   push:
     branches:
       - main
+    paths:
+      - "packages/cultmesh-ts/native/**"
+      - ".github/workflows/quic-native.yml"
     tags:
       - "cultmesh-quic-native-v*"
   pull_request:
+    paths:
+      - "packages/cultmesh-ts/native/**"
+      - ".github/workflows/quic-native.yml"
   workflow_dispatch:
 
 concurrency: