diff --git a/.gitea/workflows/publish.yml b/.gitea/workflows/publish.yml
index 34fc80b..fcc2bad 100644
--- a/.gitea/workflows/publish.yml
+++ b/.gitea/workflows/publish.yml
@@ -1,6 +1,11 @@
 # Publishing / Releases
 #
-# Trigger: push to main — i.e. when any PR merges.
+# Trigger: push to main — i.e. when any PR merges — EXCEPT pushes whose changed
+# files are confined to .gitea/** (CI/workflow edits) and/or .planning/** (GSD
+# planning docs, which push straight to main under the unprotected .planning/*
+# branch-protection pattern). Those never alter the shipped image (.dockerignore
+# already excludes .planning), so the paths-ignore filter below skips a wasted
+# build + re-push. A push that also touches code/Dockerfile/manifests still publishes.
 # Image: git.bergerhouse.net/luckberg/familysync-api
 # Tags:
 #   :latest                        — moving pointer for easy pulls
@@ -25,6 +30,12 @@ name: Publish
 on:
   push:
     branches: [main]
+    # Doc/CI-only pushes produce a byte-identical image — skip the build entirely.
+    # paths-ignore skips the run only when EVERY changed file matches; a mixed
+    # push (code + .planning) still publishes.
+    paths-ignore:
+      - '.gitea/**'
+      - '.planning/**'
 
 env:
   MILESTONE: v1.1