diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 85bfcd74..15bfb6be 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -5,8 +5,11 @@ name: Deploy GitHub Pages
 # deliberately NOT wired to push-to-main right now. site/ currently holds
 # a redesign that's still mid review/design-pass; auto-deploying on every
 # main merge shipped it to netscli.com prematurely once already. Restore
-# the `push: branches: [main], paths: ['site/**', ...]` trigger once the
-# redesign is actually approved to ship, then deploys resume automatically.
+# the push trigger once the redesign is actually approved to ship, then
+# deploys resume automatically. Copy the `paths:` list from site.yml rather
+# than writing `['site/**']`: the build also reads CHANGELOG.md,
+# scripts/install.ps1, scripts/install.sh and apps/netscli-gui/package.json,
+# so a site/**-only filter would leave changes to those undeployed.
 #
 # Until then: Actions tab → Deploy GitHub Pages → Run workflow, or
 # `gh workflow run pages.yml`.
diff --git a/.github/workflows/site-preview.yml b/.github/workflows/site-preview.yml
index 24e03ea9..8ba09d86 100644
--- a/.github/workflows/site-preview.yml
+++ b/.github/workflows/site-preview.yml
@@ -23,6 +23,10 @@ on:
     branches: [main]
     paths:
       - 'site/**'
+      - 'CHANGELOG.md'
+      - 'scripts/install.ps1'
+      - 'scripts/install.sh'
+      - 'apps/netscli-gui/package.json'
       - '.github/workflows/site-preview.yml'
   # Keep a `main` preview that tracks main, so there is always somewhere to
   # see the site as it currently is. It cannot come from the PR path: that
@@ -35,6 +39,10 @@ on:
     branches: [main]
     paths:
       - 'site/**'
+      - 'CHANGELOG.md'
+      - 'scripts/install.ps1'
+      - 'scripts/install.sh'
+      - 'apps/netscli-gui/package.json'
       - '.github/workflows/site-preview.yml'
 
 concurrency:
diff --git a/.github/workflows/site.yml b/.github/workflows/site.yml
index c3c858ad..e29ac12f 100644
--- a/.github/workflows/site.yml
+++ b/.github/workflows/site.yml
@@ -3,8 +3,19 @@ name: Site
 on:
   push:
     branches: [main]
+    # Not just site/. The build reads four files from outside it: CHANGELOG.md
+    # (changelog.astro imports it with ?raw), scripts/install.ps1 and
+    # scripts/install.sh (served at /install.ps1 and /install.sh), and
+    # apps/netscli-gui/package.json (site-content/version.ts reads the version
+    # from it). Keep this list, the `changes` job's grep below, and
+    # site-preview.yml's two filters in step -- they are the same list three
+    # times and a media query cannot read a variable here either.
     paths:
       - 'site/**'
+      - 'CHANGELOG.md'
+      - 'scripts/install.ps1'
+      - 'scripts/install.sh'
+      - 'apps/netscli-gui/package.json'
   # NOTE: deliberately unfiltered, unlike the push trigger above. `Site
   # Gate` below is a required status check, and a required check that
   # never *reports* leaves a PR stuck on "Expected — waiting for status"
@@ -51,7 +62,8 @@ jobs:
           echo "Changed files:"
           echo "$files" | sed 's/^/  /'
 
-          if echo "$files" | grep -qE '^site/'; then
+          # Same set as the push trigger's paths list above.
+          if echo "$files" | grep -qE '^(site/|CHANGELOG\.md$|scripts/install\.(ps1|sh)$|apps/netscli-gui/package\.json$)'; then
             echo "site=true" >> "$GITHUB_OUTPUT"
           else
             echo "site=false" >> "$GITHUB_OUTPUT"