diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml
index d9d81f20..9e63b7ac 100644
--- a/.github/workflows/auto-merge.yml
+++ b/.github/workflows/auto-merge.yml
@@ -11,5 +11,5 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
-    uses: go-openapi/ci-workflows/.github/workflows/auto-merge.yml@befbc52f24215555cb601b0d824b2987c1d49d0b # v0.4.3
+    uses: go-openapi/ci-workflows/.github/workflows/auto-merge.yml@81c95ab8bb6a3e0aeccc90a7c9e5fc5b398b1244 # v0.6.0
     secrets: inherit
diff --git a/.github/workflows/bump-release.yml b/.github/workflows/bump-release.yml
index 8c3a20a6..4b1cbb01 100644
--- a/.github/workflows/bump-release.yml
+++ b/.github/workflows/bump-release.yml
@@ -31,7 +31,7 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
-    uses: go-openapi/ci-workflows/.github/workflows/bump-release-monorepo.yml@befbc52f24215555cb601b0d824b2987c1d49d0b # v0.4.3
+    uses: go-openapi/ci-workflows/.github/workflows/bump-release-monorepo.yml@81c95ab8bb6a3e0aeccc90a7c9e5fc5b398b1244 # v0.6.0
     with:
       bump-type: ${{ inputs.bump-type }}
       tag-message-title: ${{ inputs.tag-message-title }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 4438eda0..8f9361af 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -18,5 +18,5 @@ jobs:
     permissions:
       contents: read
       security-events: write
-    uses: go-openapi/ci-workflows/.github/workflows/codeql.yml@befbc52f24215555cb601b0d824b2987c1d49d0b # v0.4.3
+    uses: go-openapi/ci-workflows/.github/workflows/codeql.yml@81c95ab8bb6a3e0aeccc90a7c9e5fc5b398b1244 # v0.6.0
     secrets: inherit
diff --git a/.github/workflows/contributors.yml b/.github/workflows/contributors.yml
index e178a938..a90fe977 100644
--- a/.github/workflows/contributors.yml
+++ b/.github/workflows/contributors.yml
@@ -14,5 +14,5 @@ jobs:
     permissions:
       pull-requests: write
       contents: write
-    uses: go-openapi/ci-workflows/.github/workflows/contributors.yml@befbc52f24215555cb601b0d824b2987c1d49d0b # v0.4.3
+    uses: go-openapi/ci-workflows/.github/workflows/contributors.yml@81c95ab8bb6a3e0aeccc90a7c9e5fc5b398b1244 # v0.6.0
     secrets: inherit
diff --git a/.github/workflows/go-test.yml b/.github/workflows/go-test.yml
index c21cf011..9df49155 100644
--- a/.github/workflows/go-test.yml
+++ b/.github/workflows/go-test.yml
@@ -13,5 +13,12 @@ on:
 
 jobs:
   test:
-    uses: go-openapi/ci-workflows/.github/workflows/go-test-monorepo.yml@befbc52f24215555cb601b0d824b2987c1d49d0b # v0.4.3
+    uses: go-openapi/ci-workflows/.github/workflows/go-test-monorepo.yml@81c95ab8bb6a3e0aeccc90a7c9e5fc5b398b1244 # v0.6.0
+    with:
+      # From v0.5.0 the shared workflow skips the matrix when nothing relevant changed, and
+      # what it watches is go sources. Ours are not the whole input: the integration tests
+      # compare against captured specs under fixtures/integration/golden, and a corpus that
+      # moves without a line of go moving is exactly the change those tests exist to catch.
+      extra-paths: |
+        fixtures/**
     secrets: inherit
diff --git a/.github/workflows/monitor-bot-pr.yml b/.github/workflows/monitor-bot-pr.yml
index 280aff34..09b70420 100644
--- a/.github/workflows/monitor-bot-pr.yml
+++ b/.github/workflows/monitor-bot-pr.yml
@@ -14,5 +14,5 @@ jobs:
       contents: write
       pull-requests: write
       statuses: read
-    uses: go-openapi/ci-workflows/.github/workflows/monitor-bot-pr.yml@befbc52f24215555cb601b0d824b2987c1d49d0b # v0.4.3
+    uses: go-openapi/ci-workflows/.github/workflows/monitor-bot-pr.yml@81c95ab8bb6a3e0aeccc90a7c9e5fc5b398b1244 # v0.6.0
     secrets: inherit
diff --git a/.github/workflows/scanner.yml b/.github/workflows/scanner.yml
index ae501ae6..34f34294 100644
--- a/.github/workflows/scanner.yml
+++ b/.github/workflows/scanner.yml
@@ -15,5 +15,5 @@ jobs:
     permissions:
       contents: read
       security-events: write
-    uses: go-openapi/ci-workflows/.github/workflows/scanner.yml@befbc52f24215555cb601b0d824b2987c1d49d0b # v0.4.3
+    uses: go-openapi/ci-workflows/.github/workflows/scanner.yml@81c95ab8bb6a3e0aeccc90a7c9e5fc5b398b1244 # v0.6.0
     secrets: inherit
diff --git a/.github/workflows/tag-release.yml b/.github/workflows/tag-release.yml
index 821645c6..6e2074fd 100644
--- a/.github/workflows/tag-release.yml
+++ b/.github/workflows/tag-release.yml
@@ -13,7 +13,7 @@ jobs:
     name: Create release
     permissions:
       contents: write
-    uses: go-openapi/ci-workflows/.github/workflows/release.yml@befbc52f24215555cb601b0d824b2987c1d49d0b # v0.4.3
+    uses: go-openapi/ci-workflows/.github/workflows/release.yml@81c95ab8bb6a3e0aeccc90a7c9e5fc5b398b1244 # v0.6.0
     with:
       tag: ${{ github.ref_name }}
       is-monorepo: 'true'
diff --git a/.github/workflows/update-doc.yml b/.github/workflows/update-doc.yml
index 04184c00..22b7ada8 100644
--- a/.github/workflows/update-doc.yml
+++ b/.github/workflows/update-doc.yml
@@ -3,21 +3,17 @@ name: "Update documentation"
 permissions:
   contents: read
 
+# NOTE: no "paths" filter here, on purpose. A workflow filtered out by its paths never
+# starts, so it reports no status at all — fine while nothing waits on it, useless the day
+# the doc build is pinned in the branch protection rules. Filtering happens in the
+# "changes" job below, which fails open, so the build is skipped rather than never run.
 on:
   push:
     tags:
       - v*
     branches: [ "master" ]
-    paths:
-    - docs/**
-    - hack/doc-site/**
-    - .github/workflows/update-doc.yml
 
   pull_request:
-    paths:
-    - docs/**
-    - hack/doc-site/**
-    - .github/workflows/update-doc.yml
 
 concurrency:
   group: "pages"
@@ -28,7 +24,32 @@ defaults:
     shell: bash
 
 jobs:
+  changes:
+    # description: |
+    #   Is there anything here to publish? Fails open: anything unclear rebuilds the site.
+    #
+    #   A tag push lands in that fail-open branch — a freshly created tag has no previous
+    #   commit to compare against — which is what we want, since the rendered pages carry
+    #   the latest release.
+    name: Changes
+    permissions:
+      contents: read
+      # A called workflow cannot hold more than its caller grants, and an omitted scope
+      # is 'none': without this the run is rejected before it starts.
+      pull-requests: read
+    uses: go-openapi/ci-workflows/.github/workflows/changed-paths.yml@81c95ab8bb6a3e0aeccc90a7c9e5fc5b398b1244 # v0.6.0
+    with:
+      preset: doc
+      # The preset knows the go-openapi layout — markdown anywhere, the hugo tree under
+      # hack/doc-site — but not that this repo keeps reference pages under docs/, nor that
+      # a change to this file changes what gets published.
+      extra-paths: |
+        docs/**
+        .github/workflows/update-doc.yml
+
   build-doc:
+    needs: [ changes ]
+    if: ${{ needs.changes.outputs.changed == 'true' }}
     runs-on: ubuntu-latest
     steps:
       -
diff --git a/.github/workflows/webhook-announcements.yml b/.github/workflows/webhook-announcements.yml
index 62068c6b..16006415 100644
--- a/.github/workflows/webhook-announcements.yml
+++ b/.github/workflows/webhook-announcements.yml
@@ -50,7 +50,7 @@ on:
 
 jobs:
   announce:
-    uses: go-openapi/ci-workflows/.github/workflows/webhook-announcements.yml@befbc52f24215555cb601b0d824b2987c1d49d0b # v0.4.3
+    uses: go-openapi/ci-workflows/.github/workflows/webhook-announcements.yml@81c95ab8bb6a3e0aeccc90a7c9e5fc5b398b1244 # v0.6.0
     with:
       scanned-markdown: README.md
       # On push: normal before..after diff (empty