diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml
index 5a75377..7334c57 100644
--- a/.github/workflows/dotnet.yml
+++ b/.github/workflows/dotnet.yml
@@ -1,4 +1,8 @@
 # Build and test the C# solution (server + tests). Targets repo root NeonSprawl.sln.
+# PRs: workflow always runs (so ".NET / build" can be a required check). Path-sensitive
+# work uses step-level `if` — skipped steps still leave the job successful (unlike a
+# workflow skipped via `on.paths`, which leaves the required check missing/pending).
+# push: path filter on `on` avoids redundant runs on unrelated commits to main.
 name: .NET
 
 on:
@@ -10,10 +14,12 @@ on:
       - ".github/workflows/dotnet.yml"
   pull_request:
     branches: [main]
-    paths:
-      - "NeonSprawl.sln"
-      - "server/**"
-      - ".github/workflows/dotnet.yml"
+
+# dorny/paths-filter reads the PR file list from the GitHub API; the default token
+# scope is too narrow without pull-requests:read ("Resource not accessible by integration").
+permissions:
+  contents: read
+  pull-requests: read
 
 jobs:
   build:
@@ -36,18 +42,37 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Detect .NET-relevant changes (PR only)
+        id: paths
+        if: github.event_name == 'pull_request'
+        uses: dorny/paths-filter@v3
+        with:
+          filters: |
+            server:
+              - "NeonSprawl.sln"
+              - "server/**"
+              - ".github/workflows/dotnet.yml"
+
+      - name: Skip .NET build (no server-side paths in this PR)
+        if: github.event_name == 'pull_request' && steps.paths.outputs.server != 'true'
+        run: echo "Skipping .NET restore, build, and tests."
+
       - name: Setup .NET
+        if: github.event_name == 'push' || steps.paths.outputs.server == 'true'
         uses: actions/setup-dotnet@v4
         with:
           dotnet-version: 10.0.x
 
       - name: Restore
+        if: github.event_name == 'push' || steps.paths.outputs.server == 'true'
         run: dotnet restore NeonSprawl.sln
 
       - name: Build
+        if: github.event_name == 'push' || steps.paths.outputs.server == 'true'
         run: dotnet build NeonSprawl.sln --no-restore --configuration Release
 
       - name: Test
+        if: github.event_name == 'push' || steps.paths.outputs.server == 'true'
         env:
           ConnectionStrings__NeonSprawl: >-
             Host=localhost;Port=5432;Database=neon_sprawl;Username=neon_sprawl;Password=neon_sprawl_dev