diff --git a/.config/mise/tasks/github-actions/archive-storage-contract b/.config/mise/tasks/github/actions/archive-storage-contract
similarity index 96%
rename from .config/mise/tasks/github-actions/archive-storage-contract
rename to .config/mise/tasks/github/actions/archive-storage-contract
index 0a72f9b9f..bd0317556 100755
--- a/.config/mise/tasks/github-actions/archive-storage-contract
+++ b/.config/mise/tasks/github/actions/archive-storage-contract
@@ -3,7 +3,7 @@
 
 set -eu
 
-root=$(CDPATH='' cd -- "$(dirname -- "$0")/../../../.." && pwd)
+root=$(CDPATH='' cd -- "$(dirname -- "$0")/../../../../.." && pwd)
 xunit_project="$root/src/EventStore.Core.XUnit.Tests/EventStore.Core.XUnit.Tests.csproj"
 core_project="$root/src/EventStore.Core.Tests/EventStore.Core.Tests.csproj"
 phase=${1:?archive storage phase is required}
diff --git a/.config/mise/tasks/github/actions/changed-scope b/.config/mise/tasks/github/actions/changed-scope
new file mode 100755
index 000000000..d1d944b20
--- /dev/null
+++ b/.config/mise/tasks/github/actions/changed-scope
@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+#MISE description="Write whether the change set reaches past the documentation site to GITHUB_OUTPUT"
+
+set -euo pipefail
+
+: "${GITHUB_OUTPUT:?GITHUB_OUTPUT is required}"
+: "${EVENT_NAME:?EVENT_NAME is required}"
+
+# Kept in step with the paths release-please excludes from the server release.
+documentation_paths=('docs/')
+
+emit() {
+	printf 'code=%s\n' "$1" >>"$GITHUB_OUTPUT"
+	echo "code=$1"
+	exit 0
+}
+
+if [ "$EVENT_NAME" != "pull_request" ] && [ "$EVENT_NAME" != "merge_group" ]; then
+	echo "Event '$EVENT_NAME' always exercises the full pipeline."
+	emit true
+fi
+
+: "${BASE_REF:?BASE_REF is required}"
+head_ref="${HEAD_REF:-HEAD}"
+
+if [[ "$BASE_REF" =~ ^0+$ ]]; then
+	echo "The base ref is unresolved."
+	emit true
+fi
+
+comparison_base="$BASE_REF"
+if merge_base="$(git merge-base "$BASE_REF" "$head_ref" 2>/dev/null)"; then
+	comparison_base="$merge_base"
+fi
+
+if ! changed_files="$(git diff --name-only --no-renames "$comparison_base" "$head_ref")"; then
+	echo "The change set could not be resolved."
+	emit true
+fi
+
+if [ -z "$changed_files" ]; then
+	echo "The change set is empty."
+	emit true
+fi
+
+while IFS= read -r file; do
+	for prefix in "${documentation_paths[@]}"; do
+		if [[ "$file" == "$prefix"* ]]; then
+			continue 2
+		fi
+	done
+	echo "Change outside the documentation site: $file"
+	emit true
+done <<<"$changed_files"
+
+echo "Documentation-only change set."
+emit false
diff --git a/.config/mise/tasks/github-actions/client-compatibility b/.config/mise/tasks/github/actions/client-compatibility
similarity index 99%
rename from .config/mise/tasks/github-actions/client-compatibility
rename to .config/mise/tasks/github/actions/client-compatibility
index 055fa1ab5..8d5354fb5 100755
--- a/.config/mise/tasks/github-actions/client-compatibility
+++ b/.config/mise/tasks/github/actions/client-compatibility
@@ -3,7 +3,7 @@
 
 set -eu
 
-root=$(CDPATH='' cd -- "$(dirname -- "$0")/../../../.." && pwd)
+root=$(CDPATH='' cd -- "$(dirname -- "$0")/../../../../.." && pwd)
 phase=${1:?client compatibility phase is required}
 config="$root/.github/compatibility/clients.json"
 
diff --git a/.config/mise/tasks/github-actions/container b/.config/mise/tasks/github/actions/container
similarity index 92%
rename from .config/mise/tasks/github-actions/container
rename to .config/mise/tasks/github/actions/container
index 130652418..fc51c0838 100755
--- a/.config/mise/tasks/github-actions/container
+++ b/.config/mise/tasks/github/actions/container
@@ -3,7 +3,7 @@
 
 set -eu
 
-root=$(CDPATH='' cd -- "$(dirname -- "$0")/../../../.." && pwd)
+root=$(CDPATH='' cd -- "$(dirname -- "$0")/../../../../.." && pwd)
 phase=${1:?container phase is required}
 
 cd "$root"
diff --git a/.config/mise/tasks/github-actions/docker-compose-smoke b/.config/mise/tasks/github/actions/docker-compose-smoke
similarity index 95%
rename from .config/mise/tasks/github-actions/docker-compose-smoke
rename to .config/mise/tasks/github/actions/docker-compose-smoke
index 3be4a5a58..1442513e6 100755
--- a/.config/mise/tasks/github-actions/docker-compose-smoke
+++ b/.config/mise/tasks/github/actions/docker-compose-smoke
@@ -3,7 +3,7 @@
 
 set -eu
 
-root=$(CDPATH='' cd -- "$(dirname -- "$0")/../../../.." && pwd)
+root=$(CDPATH='' cd -- "$(dirname -- "$0")/../../../../.." && pwd)
 fingerprints_before=$(mktemp)
 fingerprints_after=$(mktemp)
 compose_started=0
diff --git a/.config/mise/tasks/github-actions/dotnet-build b/.config/mise/tasks/github/actions/dotnet-build
similarity index 96%
rename from .config/mise/tasks/github-actions/dotnet-build
rename to .config/mise/tasks/github/actions/dotnet-build
index 451f7e181..8e74820ff 100755
--- a/.config/mise/tasks/github-actions/dotnet-build
+++ b/.config/mise/tasks/github/actions/dotnet-build
@@ -3,7 +3,7 @@
 
 set -euo pipefail
 
-root=$(cd -- "$(dirname -- "$0")/../../../.." && pwd)
+root=$(cd -- "$(dirname -- "$0")/../../../../.." && pwd)
 phase=${1:?dotnet build phase is required}
 
 case "$phase" in
diff --git a/.config/mise/tasks/github-actions/nuget-authenticate b/.config/mise/tasks/github/actions/nuget-authenticate
similarity index 100%
rename from .config/mise/tasks/github-actions/nuget-authenticate
rename to .config/mise/tasks/github/actions/nuget-authenticate
diff --git a/.config/mise/tasks/github-actions/publish-container b/.config/mise/tasks/github/actions/publish-container
similarity index 100%
rename from .config/mise/tasks/github-actions/publish-container
rename to .config/mise/tasks/github/actions/publish-container
diff --git a/.config/mise/tasks/github-actions/publish-container-test b/.config/mise/tasks/github/actions/publish-container-test
similarity index 100%
rename from .config/mise/tasks/github-actions/publish-container-test
rename to .config/mise/tasks/github/actions/publish-container-test
diff --git a/.config/mise/tasks/github/actions/require-successful-jobs b/.config/mise/tasks/github/actions/require-successful-jobs
new file mode 100755
index 000000000..e83fa7f8e
--- /dev/null
+++ b/.config/mise/tasks/github/actions/require-successful-jobs
@@ -0,0 +1,29 @@
+#!/bin/sh
+#MISE description="Fail unless every gated job reached the result the change scope calls for"
+
+set -eu
+
+: "${REQUIRED_JOBS:?REQUIRED_JOBS is required}"
+
+expected=skipped
+if [ "$(printf '%s' "$REQUIRED_JOBS" | jq -r '.changes.outputs.code')" = "true" ]; then
+	expected=success
+fi
+
+deviations="$(printf '%s' "$REQUIRED_JOBS" | jq -r --arg expected "$expected" '
+	to_entries
+	| map(select(
+		(.key == "changes" and .value.result != "success")
+		or (.key != "changes" and .value.result != $expected)
+	))
+	| .[]
+	| "\(.key): \(.value.result)"
+')"
+
+if [ -n "$deviations" ]; then
+	echo "Jobs did not reach '$expected':" >&2
+	echo "$deviations" >&2
+	exit 1
+fi
+
+echo "Every gated job reached '$expected'."
diff --git a/.config/mise/tasks/github-actions/resolve-comparison-refs b/.config/mise/tasks/github/actions/resolve-comparison-refs
similarity index 100%
rename from .config/mise/tasks/github-actions/resolve-comparison-refs
rename to .config/mise/tasks/github/actions/resolve-comparison-refs
diff --git a/.config/mise/tasks/github-actions/vulnerability-scan b/.config/mise/tasks/github/actions/vulnerability-scan
similarity index 85%
rename from .config/mise/tasks/github-actions/vulnerability-scan
rename to .config/mise/tasks/github/actions/vulnerability-scan
index 7750e2ce2..277c30d92 100755
--- a/.config/mise/tasks/github-actions/vulnerability-scan
+++ b/.config/mise/tasks/github/actions/vulnerability-scan
@@ -3,7 +3,7 @@
 
 set -eu
 
-root=$(CDPATH='' cd -- "$(dirname -- "$0")/../../../.." && pwd)
+root=$(CDPATH='' cd -- "$(dirname -- "$0")/../../../../.." && pwd)
 results=$(mktemp)
 trap 'rm -f "$results"' EXIT HUP INT TERM
 
diff --git a/.github/workflows/build-container-reusable.yml b/.github/workflows/build-container-reusable.yml
index 7171983b4..f8e17df8a 100644
--- a/.github/workflows/build-container-reusable.yml
+++ b/.github/workflows/build-container-reusable.yml
@@ -82,7 +82,7 @@ jobs:
             nuget_auth_token=${{ secrets.GITHUB_TOKEN }}
       - name: Verify Build
         if: ${{ inputs.mode != 'test-only' }}
-        run: mise run --skip-tools github-actions:container -- verify
+        run: mise run --skip-tools github:actions:container -- verify
       - name: Build Test Container
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         if: ${{ inputs.mode != 'test-only' }}
@@ -100,10 +100,10 @@ jobs:
             nuget_auth_token=${{ secrets.GITHUB_TOKEN }}
       - name: Export Test Container
         if: ${{ inputs.mode == 'build-only' }}
-        run: mise run --skip-tools github-actions:container -- export-test
+        run: mise run --skip-tools github:actions:container -- export-test
       - name: Export Container
         if: ${{ inputs.mode == 'build-only' }}
-        run: mise run --skip-tools github-actions:container -- export-runtime
+        run: mise run --skip-tools github:actions:container -- export-runtime
       - name: Publish Test Container
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: ${{ inputs.mode == 'build-only' }}
@@ -127,15 +127,15 @@ jobs:
           name: ${{ inputs.test-image-artifact-name }}
       - name: Load Test Container
         if: ${{ inputs.mode == 'test-only' }}
-        run: mise run --skip-tools github-actions:container -- load-test
+        run: mise run --skip-tools github:actions:container -- load-test
       - name: Run Tests
         if: ${{ inputs.mode != 'build-only' }}
         env:
           TEST_GROUP: ${{ inputs.test-group-name }}
-        run: mise run --skip-tools github-actions:container -- test
+        run: mise run --skip-tools github:actions:container -- test
       - name: Normalize Test Result Permissions
         if: ${{ failure() && steps.mise.outcome == 'success' }}
-        run: mise run --skip-tools github-actions:container -- normalize-results
+        run: mise run --skip-tools github:actions:container -- normalize-results
       - name: Publish Test Results
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: failure()
diff --git a/.github/workflows/build-container-ubuntu-lts.yml b/.github/workflows/build-container-ubuntu-lts.yml
index 75ca24883..b87f61c34 100644
--- a/.github/workflows/build-container-ubuntu-lts.yml
+++ b/.github/workflows/build-container-ubuntu-lts.yml
@@ -17,7 +17,13 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  changes:
+    name: Changes
+    uses: ./.github/workflows/changes-reusable.yml
+
   build-images:
+    needs: changes
+    if: ${{ needs.changes.outputs.code == 'true' }}
     name: Build Images
     uses: ./.github/workflows/build-container-reusable.yml
     with:
@@ -30,7 +36,10 @@ jobs:
 
   test:
     name: Build (${{ matrix.test-group-name }})
-    needs: build-images
+    needs:
+      - changes
+      - build-images
+    if: ${{ needs.changes.outputs.code == 'true' }}
     strategy:
       fail-fast: true
       matrix:
@@ -58,8 +67,10 @@ jobs:
   client-compatibility:
     name: Client Compatibility
     needs:
+      - changes
       - build-images
       - test
+    if: ${{ needs.changes.outputs.code == 'true' }}
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -86,7 +97,7 @@ jobs:
           rustup default stable
       - name: Resolve client revisions
         id: clients
-        run: mise run --skip-tools github-actions:client-compatibility -- refs
+        run: mise run --skip-tools github:actions:client-compatibility -- refs
       - name: Checkout C# client
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -106,9 +117,9 @@ jobs:
         with:
           name: eventstore-image-noble-linux-x64
       - name: Load server image
-        run: mise run --skip-tools github-actions:container -- load-runtime
+        run: mise run --skip-tools github:actions:container -- load-runtime
       - name: Run client compatibility gate
-        run: mise run --skip-tools github-actions:client-compatibility -- run
+        run: mise run --skip-tools github:actions:client-compatibility -- run
       - name: Publish compatibility evidence
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
@@ -137,13 +148,25 @@ jobs:
     name: Container CI
     if: ${{ always() }}
     needs:
+      - changes
       - build-images
       - test
       - client-compatibility
     runs-on: ubuntu-latest
-    permissions: {}
+    permissions:
+      contents: read
     steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install task runner
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        with:
+          version: 2026.8.2
+          install: false
+          cache: false
       - name: Require successful jobs
         env:
           REQUIRED_JOBS: ${{ toJSON(needs) }}
-        run: jq -e 'all(.[]; .result == "success")' <<< "$REQUIRED_JOBS"
+        run: mise run --skip-tools github:actions:require-successful-jobs
diff --git a/.github/workflows/build-reusable.yml b/.github/workflows/build-reusable.yml
index b9ee8a51a..3fdd85d3d 100644
--- a/.github/workflows/build-reusable.yml
+++ b/.github/workflows/build-reusable.yml
@@ -42,26 +42,26 @@ jobs:
         env:
           NUGET_GITHUB_ACTOR: ${{ github.actor }}
           NUGET_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: mise run --skip-tools github-actions:nuget-authenticate
+        run: mise run --skip-tools github:actions:nuget-authenticate
       - name: Compile
         env:
           BUILD_CONFIGURATION: ${{ matrix.configuration }}
           NUGET_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TARGET_ARCH: ${{ inputs.arch }}
-        run: mise run --skip-tools github-actions:dotnet-build -- compile
+        run: mise run --skip-tools github:actions:dotnet-build -- compile
       - name: Verify Build
         env:
           BUILD_CONFIGURATION: ${{ matrix.configuration }}
           TARGET_ARCH: ${{ inputs.arch }}
-        run: mise run --skip-tools github-actions:dotnet-build -- verify
+        run: mise run --skip-tools github:actions:dotnet-build -- verify
       - name: Run Tests
         env:
           BUILD_CONFIGURATION: ${{ matrix.configuration }}
           TARGET_ARCH: ${{ inputs.arch }}
-        run: mise run --skip-tools github-actions:dotnet-build -- test
+        run: mise run --skip-tools github:actions:dotnet-build -- test
       - name: Collect Test Results
         if: ${{ always() && steps.mise.outcome == 'success' }}
-        run: mise run --skip-tools github-actions:dotnet-build -- collect-results
+        run: mise run --skip-tools github:actions:dotnet-build -- collect-results
       - name: Publish Test Results (HTML)
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
diff --git a/.github/workflows/build-ubuntu-lts-arm64.yml b/.github/workflows/build-ubuntu-lts-arm64.yml
index 2c7e9e281..7dc5ec5cd 100644
--- a/.github/workflows/build-ubuntu-lts-arm64.yml
+++ b/.github/workflows/build-ubuntu-lts-arm64.yml
@@ -17,7 +17,13 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  changes:
+    name: Changes
+    uses: ./.github/workflows/changes-reusable.yml
+
   build:
+    needs: changes
+    if: ${{ needs.changes.outputs.code == 'true' }}
     name: Build
     uses: ./.github/workflows/build-reusable.yml
     with:
@@ -29,11 +35,23 @@ jobs:
     name: ARM64 CI
     if: ${{ always() }}
     needs:
+      - changes
       - build
     runs-on: ubuntu-latest
-    permissions: {}
+    permissions:
+      contents: read
     steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install task runner
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        with:
+          version: 2026.8.2
+          install: false
+          cache: false
       - name: Require successful jobs
         env:
           REQUIRED_JOBS: ${{ toJSON(needs) }}
-        run: jq -e 'all(.[]; .result == "success")' <<< "$REQUIRED_JOBS"
+        run: mise run --skip-tools github:actions:require-successful-jobs
diff --git a/.github/workflows/build-ubuntu-lts-x64.yml b/.github/workflows/build-ubuntu-lts-x64.yml
index 0e08a8f23..4f9f1b9e1 100644
--- a/.github/workflows/build-ubuntu-lts-x64.yml
+++ b/.github/workflows/build-ubuntu-lts-x64.yml
@@ -13,7 +13,13 @@ on:
       - v*
 
 jobs:
+  changes:
+    name: Changes
+    uses: ./.github/workflows/changes-reusable.yml
+
   build:
+    needs: changes
+    if: ${{ needs.changes.outputs.code == 'true' }}
     name: Build
     uses: ./.github/workflows/build-reusable.yml
     with:
@@ -25,11 +31,23 @@ jobs:
     name: X64 CI
     if: ${{ always() }}
     needs:
+      - changes
       - build
     runs-on: ubuntu-latest
-    permissions: {}
+    permissions:
+      contents: read
     steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install task runner
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        with:
+          version: 2026.8.2
+          install: false
+          cache: false
       - name: Require successful jobs
         env:
           REQUIRED_JOBS: ${{ toJSON(needs) }}
-        run: jq -e 'all(.[]; .result == "success")' <<< "$REQUIRED_JOBS"
+        run: mise run --skip-tools github:actions:require-successful-jobs
diff --git a/.github/workflows/changes-reusable.yml b/.github/workflows/changes-reusable.yml
new file mode 100644
index 000000000..ee958997e
--- /dev/null
+++ b/.github/workflows/changes-reusable.yml
@@ -0,0 +1,48 @@
+name: Changes - Reusable
+
+on:
+  workflow_call:
+    outputs:
+      code:
+        description: Whether the change set reaches past the documentation site
+        value: ${{ jobs.detect.outputs.code }}
+
+permissions:
+  contents: read
+
+jobs:
+  detect:
+    runs-on: ubuntu-latest
+    name: Changes
+    outputs:
+      code: ${{ steps.scope.outputs.code }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Install task runner
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        with:
+          version: 2026.8.2
+          install: false
+          cache: false
+      - name: Resolve comparison refs
+        id: refs
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          MERGE_GROUP_BASE_SHA: ${{ github.event.merge_group.base_sha }}
+          MERGE_GROUP_HEAD_SHA: ${{ github.event.merge_group.head_sha }}
+          BEFORE_SHA: ${{ github.event.before }}
+          CURRENT_SHA: ${{ github.sha }}
+        run: mise run --skip-tools github:actions:resolve-comparison-refs
+      - name: Resolve change scope
+        id: scope
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          BASE_REF: ${{ steps.refs.outputs.base }}
+          HEAD_REF: ${{ steps.refs.outputs.head }}
+        run: mise run --skip-tools github:actions:changed-scope
diff --git a/.github/workflows/common.yml b/.github/workflows/common.yml
index 3bf83919b..092a9a5a8 100644
--- a/.github/workflows/common.yml
+++ b/.github/workflows/common.yml
@@ -22,7 +22,13 @@ permissions:
   packages: read
 
 jobs:
+  changes:
+    name: Changes
+    uses: ./.github/workflows/changes-reusable.yml
+
   semantic-conventions:
+    needs: changes
+    if: ${{ needs.changes.outputs.code == 'true' }}
     runs-on: ubuntu-latest
     name: Semantic Conventions
     steps:
@@ -40,6 +46,8 @@ jobs:
         run: mise run --skip-tools semconv:check
 
   csharp-quality:
+    needs: changes
+    if: ${{ needs.changes.outputs.code == 'true' }}
     runs-on: ubuntu-latest
     name: C# Quality
     steps:
@@ -61,7 +69,7 @@ jobs:
         env:
           NUGET_GITHUB_ACTOR: ${{ github.actor }}
           NUGET_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: mise run --skip-tools github-actions:nuget-authenticate
+        run: mise run --skip-tools github:actions:nuget-authenticate
       - name: Resolve comparison refs
         id: refs
         env:
@@ -72,7 +80,7 @@ jobs:
           MERGE_GROUP_HEAD_SHA: ${{ github.event.merge_group.head_sha }}
           BEFORE_SHA: ${{ github.event.before }}
           CURRENT_SHA: ${{ github.sha }}
-        run: mise run --skip-tools github-actions:resolve-comparison-refs
+        run: mise run --skip-tools github:actions:resolve-comparison-refs
       - name: Restore
         run: |
           dotnet restore src/EventStore.sln
@@ -88,6 +96,8 @@ jobs:
             src/TrogonEventStore.SemanticConventions/TrogonEventStore.SemanticConventions.csproj
 
   vulnerability-scan:
+    needs: changes
+    if: ${{ needs.changes.outputs.code == 'true' }}
     runs-on: ubuntu-latest
     name: Scan for Vulnerabilities
     steps:
@@ -107,11 +117,13 @@ jobs:
         env:
           NUGET_GITHUB_ACTOR: ${{ github.actor }}
           NUGET_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: mise run --skip-tools github-actions:nuget-authenticate
+        run: mise run --skip-tools github:actions:nuget-authenticate
       - name: Scan for Vulnerabilities
-        run: mise run --skip-tools github-actions:vulnerability-scan
+        run: mise run --skip-tools github:actions:vulnerability-scan
 
   protolock:
+    needs: changes
+    if: ${{ needs.changes.outputs.code == 'true' }}
     runs-on: ubuntu-latest
     name: Protolock Status
     steps:
@@ -123,6 +135,8 @@ jobs:
           ./protolock.sh status --uptodate
 
   release-metadata:
+    needs: changes
+    if: ${{ needs.changes.outputs.code == 'true' }}
     runs-on: ubuntu-latest
     name: Release Metadata
     steps:
@@ -140,9 +154,11 @@ jobs:
       - name: Verify release metadata
         run: mise run --skip-tools release-metadata:check
       - name: Verify container publication tags
-        run: mise run --skip-tools github-actions:publish-container-test
+        run: mise run --skip-tools github:actions:publish-container-test
 
   archive-storage-contract:
+    needs: changes
+    if: ${{ needs.changes.outputs.code == 'true' }}
     runs-on: ubuntu-latest
     name: Archive Storage Contract
     env:
@@ -183,37 +199,39 @@ jobs:
         env:
           NUGET_GITHUB_ACTOR: ${{ github.actor }}
           NUGET_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: mise run --skip-tools github-actions:nuget-authenticate
+        run: mise run --skip-tools github:actions:nuget-authenticate
       - name: Run archive storage contract tests
-        run: mise run --skip-tools github-actions:archive-storage-contract -- contract
+        run: mise run --skip-tools github:actions:archive-storage-contract -- contract
 
       - name: Seed archive restart recovery data
         id: seed_archive_recovery
         env:
           EVENTSTORE_S3_RECOVERY_PHASE: seed
-        run: mise run --skip-tools github-actions:archive-storage-contract -- recovery
+        run: mise run --skip-tools github:actions:archive-storage-contract -- recovery
 
       - name: Stop RustFS without removing its data
         env:
           RUSTFS_CONTAINER_ID: ${{ job.services.rustfs.id }}
-        run: mise run --skip-tools github-actions:archive-storage-contract -- stop-storage
+        run: mise run --skip-tools github:actions:archive-storage-contract -- stop-storage
 
       - name: Assert archive storage is unavailable
         env:
           EVENTSTORE_S3_RECOVERY_PHASE: unavailable
-        run: mise run --skip-tools github-actions:archive-storage-contract -- recovery
+        run: mise run --skip-tools github:actions:archive-storage-contract -- recovery
 
       - name: Restart RustFS and verify archive recovery
         if: ${{ always() && steps.seed_archive_recovery.outcome == 'success' }}
         env:
           EVENTSTORE_S3_RECOVERY_PHASE: verify-cleanup
           RUSTFS_CONTAINER_ID: ${{ job.services.rustfs.id }}
-        run: mise run --skip-tools github-actions:archive-storage-contract -- restart-and-verify
+        run: mise run --skip-tools github:actions:archive-storage-contract -- restart-and-verify
 
       - name: Run archive cluster restore gate
-        run: mise run --skip-tools github-actions:archive-storage-contract -- cluster-restore
+        run: mise run --skip-tools github:actions:archive-storage-contract -- cluster-restore
 
   docker-compose:
+    needs: changes
+    if: ${{ needs.changes.outputs.code == 'true' }}
     runs-on: ubuntu-latest
     name: Docker Compose Smoke Test
     steps:
@@ -235,12 +253,13 @@ jobs:
         env:
           DOCKER_BUILDKIT: 1
           NUGET_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: mise run --skip-tools github-actions:docker-compose-smoke
+        run: mise run --skip-tools github:actions:docker-compose-smoke
 
   required:
     name: Common CI
     if: ${{ always() }}
     needs:
+      - changes
       - semantic-conventions
       - csharp-quality
       - vulnerability-scan
@@ -249,9 +268,20 @@ jobs:
       - archive-storage-contract
       - docker-compose
     runs-on: ubuntu-latest
-    permissions: {}
+    permissions:
+      contents: read
     steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install task runner
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        with:
+          version: 2026.8.2
+          install: false
+          cache: false
       - name: Require successful jobs
         env:
           REQUIRED_JOBS: ${{ toJSON(needs) }}
-        run: jq -e 'all(.[]; .result == "success")' <<< "$REQUIRED_JOBS"
+        run: mise run --skip-tools github:actions:require-successful-jobs
diff --git a/.github/workflows/tag-docker-images.yml b/.github/workflows/tag-docker-images.yml
index 63c9bbb52..0f04f4750 100644
--- a/.github/workflows/tag-docker-images.yml
+++ b/.github/workflows/tag-docker-images.yml
@@ -27,7 +27,7 @@ jobs:
         with:
           name: ${{ inputs.image-artifact-name }}
       - name: Load Container
-        run: mise run --skip-tools github-actions:container -- load-runtime
+        run: mise run --skip-tools github:actions:container -- load-runtime
       - name: Login to GitHub Container Registry
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
@@ -37,4 +37,4 @@ jobs:
       - name: Publish Container
         env:
           IMAGE: ghcr.io/trogonstack/trogoneventstore
-        run: mise run --skip-tools github-actions:publish-container
+        run: mise run --skip-tools github:actions:publish-container