diff --git a/.github/filters.yml b/.github/filters.yml
new file mode 100644
index 00000000..3707778f
--- /dev/null
+++ b/.github/filters.yml
@@ -0,0 +1,12 @@
+# Keep fixture and template Markdown/metadata covered; exclude docs by location.
+# Workflows use token: '' for git-based detection without PR API permissions.
+# All rules are exclusions, combined with predicate-quantifier: every.
+changed:
+  - '!*.{md,mdx}'
+  - '!packages/*/{README*,CHANGELOG*,AGENTS}.md'
+  - '!{.agents,.vscode}/**'
+  - '!.github/ISSUE_TEMPLATE/**'
+  - '!.github/{FUNDING.yml,renovate.json,renovate.json5,PULL_REQUEST_TEMPLATE.md}'
+  - '!{skills-lock.json,skills.json,cspell.config.*}'
+  - '!scripts/dictionary.txt'
+  - '!website/**'
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index c7ebb5bf..efcf0fad 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -29,50 +29,47 @@ jobs:
 
       - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         id: changes
+        # Manual runs leave the output unset; only 'false' skips later steps.
+        if: github.event_name != 'workflow_dispatch'
         with:
+          token: ''
           predicate-quantifier: 'every'
-          filters: |
-            changed:
-              - "!**/*.md"
-              - "!**/*.mdx"
-              - "!**/_meta.json"
-              - "!**/_nav.json"
-              - "!**/dictionary.txt"
+          filters: .github/filters.yml
 
       - name: Setup Node.js
-        if: steps.changes.outputs.changed == 'true'
+        if: steps.changes.outputs.changed != 'false'
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: 24.22.2
           package-manager-cache: false
 
       - name: Install Pnpm
-        if: steps.changes.outputs.changed == 'true'
+        if: steps.changes.outputs.changed != 'false'
         uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         with:
           run_install: true
 
       - name: Build Packages
-        if: steps.changes.outputs.changed == 'true'
+        if: steps.changes.outputs.changed != 'false'
         run: node --run build
 
       - name: Run Rust Tests
-        if: steps.changes.outputs.changed == 'true'
+        if: steps.changes.outputs.changed != 'false'
         run: cargo test --profile ci --workspace --locked
 
       - name: Build Native Binding
-        if: steps.changes.outputs.changed == 'true'
+        if: steps.changes.outputs.changed != 'false'
         run: pnpm --filter rstack build:native:ci
 
       - name: Check Generated Native Files
-        if: steps.changes.outputs.changed == 'true'
+        if: steps.changes.outputs.changed != 'false'
         run: git diff --exit-code -- packages/rstack/binding.cjs packages/rstack/binding.d.cts
 
       - name: Run Test
-        if: steps.changes.outputs.changed == 'true' && runner.os != 'Windows'
+        if: steps.changes.outputs.changed != 'false' && runner.os != 'Windows'
         run: node --run test
 
       # Run package tests serially on Windows to avoid resource contention between nested test workers.
       - name: Run Test (Windows)
-        if: steps.changes.outputs.changed == 'true' && runner.os == 'Windows'
+        if: steps.changes.outputs.changed != 'false' && runner.os == 'Windows'
         run: pnpm --workspace-concurrency=1 --filter "./packages/**" test