diff --git a/.github/workflows/conformance-frame-alignment.yml b/.github/workflows/conformance-frame-alignment.yml
index dfedc82ea..c265a7fb4 100644
--- a/.github/workflows/conformance-frame-alignment.yml
+++ b/.github/workflows/conformance-frame-alignment.yml
@@ -2,6 +2,7 @@ name: Conformance frame alignment
 on:
   workflow_dispatch:
   push:
+    branches: [main]
     paths:
       - 'conformance/**'
       - 'fpga/vivado/**'
@@ -11,11 +12,13 @@ on:
       - 'conformance/frame_alignment_check.py'
       - 'conformance/gfternary_compute_conformance_ax7203.py'
       - 'conformance/trinet_mac32_conformance_ax7203.py'
+  # every push path, so a PR that touches only one of them still runs this
   pull_request:
     paths:
       - 'conformance/**'
       - 'fpga/vivado/**'
       - 'fpga/openxc7-synth/**'
+      - '.github/workflows/conformance-frame-alignment.yml'
   schedule:
     # Daily, so a wrapper edit that silently orphans a host surfaces within a
     # day rather than at the next flash session.
diff --git a/.github/workflows/conformance-selftest.yml b/.github/workflows/conformance-selftest.yml
index 4d0eac464..86e71bd4c 100644
--- a/.github/workflows/conformance-selftest.yml
+++ b/.github/workflows/conformance-selftest.yml
@@ -17,9 +17,11 @@ on:
       - 'conformance/compute_golden_consistency.py'
       - 'conformance/corona_decode_host_ax7203.py'
       - 'conformance/golden_consistency.py'
+  # every push path, so a PR that touches only one of them still runs this
   pull_request:
     paths:
       - 'conformance/**'
+      - '.github/workflows/conformance-selftest.yml'
 
 jobs:
   selftest:
diff --git a/.github/workflows/fpga-regression.yml b/.github/workflows/fpga-regression.yml
index 7157f2ae9..f98fc3c82 100644
--- a/.github/workflows/fpga-regression.yml
+++ b/.github/workflows/fpga-regression.yml
@@ -19,12 +19,15 @@ on:
       - 'src/tri/tri_sacred_fpga.zig'
       - 'fpga/openxc7-synth/**'
       - '.github/workflows/fpga-regression.yml'
+  # every push path, so a PR that touches only one of them still runs this
   pull_request:
     branches: [main]
     paths:
       - 'specs/fpga/**'
       - 'src/tri/tri_fpga.zig'
+      - 'src/tri/tri_sacred_fpga.zig'
       - 'fpga/openxc7-synth/**'
+      - '.github/workflows/fpga-regression.yml'
   workflow_dispatch:
 
 env:
diff --git a/.github/workflows/gates-can-fail.yml b/.github/workflows/gates-can-fail.yml
index 12278e93f..54bacf2bc 100644
--- a/.github/workflows/gates-can-fail.yml
+++ b/.github/workflows/gates-can-fail.yml
@@ -38,6 +38,7 @@ name: Gates can fail
 
 on:
   push:
+    branches: [main]
     paths:
       - 'tools/check_*.py'
       - 'tools/materialise_siblings.sh'
diff --git a/.github/workflows/gf-adder-ref-tb.yml b/.github/workflows/gf-adder-ref-tb.yml
index 1e62e4bd3..d14f8453a 100644
--- a/.github/workflows/gf-adder-ref-tb.yml
+++ b/.github/workflows/gf-adder-ref-tb.yml
@@ -15,12 +15,14 @@ on:
       - 'formal/gf_adder_ref_tb.v'
       - 'formal/gf_mul_ref_tb.v'
       - '.github/workflows/gf-adder-ref-tb.yml'
+  # every push path, so a PR that touches only one of them still runs this
   pull_request:
     paths:
       - 'fpga/openxc7-synth/gf_adder_param.v'
       - 'fpga/openxc7-synth/gf_mul_param.v'
       - 'formal/gf_adder_ref_tb.v'
       - 'formal/gf_mul_ref_tb.v'
+      - '.github/workflows/gf-adder-ref-tb.yml'
 
 jobs:
   ref-tb:
diff --git a/.github/workflows/reachability-ratchet.yml b/.github/workflows/reachability-ratchet.yml
index 57e9dd257..544afe528 100644
--- a/.github/workflows/reachability-ratchet.yml
+++ b/.github/workflows/reachability-ratchet.yml
@@ -26,14 +26,17 @@ name: reachability ratchet
 
 on:
   push:
+    branches: [main]
     paths:
       - 'src/tri/**'
       - 'build.zig'
       - '.github/workflows/reachability-ratchet.yml'
+  # every push path, so a PR that touches only one of them still runs this
   pull_request:
     paths:
       - 'src/tri/**'
       - 'build.zig'
+      - '.github/workflows/reachability-ratchet.yml'
   workflow_dispatch:
 
 # GitHub's default step shell is `bash -e {0}` -- NO pipefail. In `measurer | tee
diff --git a/.github/workflows/rtl-check.yml b/.github/workflows/rtl-check.yml
index b1d9e43e5..32412202a 100644
--- a/.github/workflows/rtl-check.yml
+++ b/.github/workflows/rtl-check.yml
@@ -6,17 +6,21 @@ name: RTL check
 # resolving the ref, reading the inputs across the boundary, checking out the
 # CALLER's code rather than the callee's.
 #
-# It also means these two chips are checked on every push by the same thing that
-# is offered to strangers, which is the only honest way to offer it.
+# It also means these two chips are checked on every PR commit and every push to
+# main by the same thing that is offered to strangers, which is the only honest
+# way to offer it.
 
 on:
   push:
+    branches: [main]
     paths:
       - 'ttsky26c/**'
       - '.github/workflows/rtl-check.yml'
+  # every push path, so a PR that touches only one of them still runs this
   pull_request:
     paths:
       - 'ttsky26c/**'
+      - '.github/workflows/rtl-check.yml'
   workflow_dispatch:
 
 permissions:
diff --git a/.github/workflows/tri-build.yml b/.github/workflows/tri-build.yml
index 810b6d555..e5867d7ba 100644
--- a/.github/workflows/tri-build.yml
+++ b/.github/workflows/tri-build.yml
@@ -28,18 +28,21 @@ name: tri builds
 
 on:
   push:
+    branches: [main]
     paths:
       - 'build.zig'
       - 'build.zig.zon'
       - 'src/tri/**'
       - 'src/vsa**'
       - '.github/workflows/tri-build.yml'
+  # every push path, so a PR that touches only one of them still runs this
   pull_request:
     paths:
       - 'build.zig'
       - 'build.zig.zon'
       - 'src/tri/**'
       - 'src/vsa**'
+      - '.github/workflows/tri-build.yml'
   workflow_dispatch:
 
 env:
diff --git a/.github/workflows/trinet-portability.yml b/.github/workflows/trinet-portability.yml
index 3a9be357c..2ce10f66f 100644
--- a/.github/workflows/trinet-portability.yml
+++ b/.github/workflows/trinet-portability.yml
@@ -14,6 +14,7 @@ name: TRI-NET portability and receipt keys
 on:
   workflow_dispatch:
   push:
+    branches: [main]
     paths:
       - 'fpga/portable/**'
       - 'fpga/vivado/trinet_node_v2_ax7203.v'
@@ -23,6 +24,7 @@ on:
       - '.github/workflows/trinet-portability.yml'
       # the scripts this job runs: fixing a check must re-run it
       - 'conformance/portability_check.py'
+  # every push path, so a PR that touches only one of them still runs this
   pull_request:
     paths:
       - 'fpga/portable/**'
@@ -30,6 +32,8 @@ on:
       - 'fpga/openxc7-synth/trinet_siphash24.v'
       - 'formal/trinet_node_v2_tb.v'
       - 'conformance/key_default_check.py'
+      - '.github/workflows/trinet-portability.yml'
+      - 'conformance/portability_check.py'
   schedule:
     - cron: '41 5 * * *'