diff --git a/.gitea/workflows/build-ci-image.yaml b/.gitea/workflows/build-ci-image.yaml
index 9cea8bb..a2ede71 100644
--- a/.gitea/workflows/build-ci-image.yaml
+++ b/.gitea/workflows/build-ci-image.yaml
@@ -13,6 +13,10 @@
 name: build-ci-image
 on:
   push:
+    # Branch pushes only. Tag pushes ignore `paths:` filters and would rebuild
+    # the (unchanged) image on every release tag — `branches: ['**']` excludes
+    # tags, so this runs only when a branch push actually changes an image input.
+    branches: ['**']
     paths:
       - '.gitea/ci-image/Dockerfile'
       - 'flake.nix'
diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index cdf32f9..0505252 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -8,6 +8,11 @@
 name: ci
 on:
   push:
+    # Branch pushes only — a tag push hits the same commit the branch push
+    # already gated, so `branches: ['**']` drops the redundant tag-triggered
+    # run (the release workflow owns tags). Pushing commits + a tag together
+    # still gates the commits via the branch push.
+    branches: ['**']
   pull_request:
 
 jobs: