diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ffcbc1d..481e577 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,13 +1,34 @@
 name: CI
 
-# Pull requests (any base branch) get the full checks and testable packages. Branches without a pull request
-# run nothing; main and master are checked on push because the release workflow waits for that result.
+# Pull requests (any base branch) get the full checks and testable packages. Changes that only touch docs, the
+# website, developer tooling or repository metadata skip it (the website has its own workflow, pr-packages.yml
+# runs from the default branch and cannot be tested here). Branches without a pull request run nothing; main and master are checked on push because the release workflow waits for that result.
 on:
   pull_request:
+    paths-ignore:
+      - "**/*.md"
+      - docs/**
+      - website/**
+      - LICENSE
+      - .github/FUNDING.yml
+      - .github/dependabot.yml
+      - .github/workflows/website.yml
+      - .github/workflows/pr-packages.yml
+      - tools/**
   push:
     branches:
       - main
       - master
+    paths-ignore:
+      - "**/*.md"
+      - docs/**
+      - website/**
+      - LICENSE
+      - .github/FUNDING.yml
+      - .github/dependabot.yml
+      - .github/workflows/website.yml
+      - .github/workflows/pr-packages.yml
+      - tools/**
 
 permissions: {}
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index eab0d93..41f9bba 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -89,6 +89,12 @@ jobs:
             ci_run="$(jq -c '[.[] | select(.event == "push")] | first // empty' <<< "$runs")"
 
             if [[ -z "$ci_run" ]]; then
+              # CI skips commits that only touch docs, the website or repository metadata. Give a real run
+              # a few minutes to appear, then stop instead of waiting out the whole timeout.
+              if (( SECONDS > 300 )); then
+                echo "No CI run exists for $COMMIT_SHA (it may have been skipped as docs-only). Push a code change or re-run CI before releasing." >&2
+                exit 1
+              fi
               echo "Waiting for the CI workflow run for $COMMIT_SHA to appear..."
               sleep 15
               continue
diff --git a/docs/PACKAGING.md b/docs/PACKAGING.md
index d19736c..215fd51 100644
--- a/docs/PACKAGING.md
+++ b/docs/PACKAGING.md
@@ -71,7 +71,7 @@ packaging/build-linux.sh linux-portable 0.19.0 out
 | `release.yml` | `VERSION` changes on `main`/`master`, or manual dispatch from the default branch | prepare (version `0.<VERSION>.<next patch>`, 0ver: `VERSION` is only the minor number), wait for the matching CI run, validate (build and test on Windows and Ubuntu), call `packages.yml`, then verify the exact asset list, write `BrightSync-SHA256SUMS.txt` and upload to the GitHub Release |
 | `website.yml` | changes under `website/` | Builds the site, deploys it to GitHub Pages from `main`/`master` |
 
-A branch without a pull request runs nothing. Open a draft pull request to get the test legs without the package builds.
+CI skips changes that only touch `**/*.md`, `docs/**`, `website/**`, `tools/**`, `LICENSE`, `.github/FUNDING.yml`, `.github/dependabot.yml`, `website.yml` or `pr-packages.yml`; the website has its own workflow. `release.yml` fails after five minutes if the commit it runs on has no CI run (docs-only), so release from a commit that touched code. Do not make a CI job a required status check: a skipped workflow would block docs-only pull requests. A branch without a pull request runs nothing. Open a draft pull request to get the test legs without the package builds.
 
 ### Pull request builds on a public repository