diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3cf7f908..3a781566 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,6 +1,8 @@
 name: CI
 
-# Windows tests are gated on Go, workflow and Go test script changes for pull requests and branch pushes.
+# Pull requests run the Windows tests only when Go sources, modules, test data,
+# tools/, the configuration examples or this workflow change. Pushes, tags and
+# releases always run them.
 on:
   push:
     branches:
@@ -38,25 +40,34 @@ jobs:
         shell: bash
         env:
           EVENT_NAME: ${{ github.event_name }}
-          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
         run: |
-          # Manual, tag, release, and new-branch runs have no previous revision to compare.
-          if [[ "$EVENT_NAME" != "pull_request" && "$EVENT_NAME" != "push" ]] ||
-            [[ "$GITHUB_REF" == refs/tags/* || -z "$BASE_SHA" || "$BASE_SHA" =~ ^0+$ ]]; then
+          # Pushes to main and the release branches, tags, releases and manual
+          # runs always test, so a gap in the filter below cannot let a
+          # regression reach a branch that ships.
+          if [[ "$EVENT_NAME" != "pull_request" || -z "$BASE_SHA" ]]; then
             echo "changed=true" >> "$GITHUB_OUTPUT"
             exit 0
           fi
 
-          if [[ "$EVENT_NAME" == "pull_request" ]]; then
-            BASE_SHA=$(git merge-base "$BASE_SHA" "$HEAD_SHA")
-          elif ! git cat-file -e "$BASE_SHA^{commit}"; then
-            # A force push may remove the previous commit from the fetched history.
-            echo "changed=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
+          BASE_SHA=$(git merge-base "$BASE_SHA" "$HEAD_SHA")
 
-          changed_files=$(git diff --name-only "$BASE_SHA" "$HEAD_SHA" -- '*.go' '.github/workflows/ci.yml' 'tools/build-go-tests.ps1' 'tools/run-go-tests.ps1')
+          # Everything that changes the tested binaries or the fixtures: Go
+          # sources, module versions, test data, the fixture and test scripts
+          # in tools/ and this workflow. internal/config/config_test.go also
+          # validates config.yaml, docs/example_config.yml and the examples in
+          # docs/collector.*.md. Git pathspec wildcards also match "/".
+          changed_files=$(git diff --name-only "$BASE_SHA" "$HEAD_SHA" -- \
+            '*.go' \
+            'go.mod' \
+            'go.sum' \
+            ':(glob)**/testdata/**' \
+            'tools/' \
+            'config.yaml' \
+            'docs/example_config.yml' \
+            'docs/collector.*.md' \
+            '.github/workflows/ci.yml')
           if [[ -n "$changed_files" ]]; then
             echo "changed=true" >> "$GITHUB_OUTPUT"
           else
@@ -1779,17 +1790,13 @@ jobs:
             ${{ runner.temp }}/cbs.log
           if-no-files-found: ignore
 
+  # Linting type-checks the Windows build from Linux: GOOS=windows selects the
+  # same files, the code uses no cgo, and Linux checkouts keep LF line endings.
   lint:
-    runs-on: windows-2025
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
     steps:
-      # `gofmt` linter run by golangci-lint fails on CRLF line endings (the default for Windows)
-      - name: Set git to use LF
-        run: |
-          git config --global core.autocrlf false
-          git config --global core.eol lf
-
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: 'false'
@@ -1799,8 +1806,13 @@ jobs:
           # renovate: golang=go
           go-version: '1.27.2'
 
+      # Only the lint step targets Windows; the action installs the Linux
+      # golangci-lint binary for the runner.
       - name: golangci-lint
         uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
+        env:
+          GOOS: windows
+          GOARCH: amd64
         with:
           # renovate: github=golangci/golangci-lint
           version: v2.14.0
diff --git a/.github/workflows/mixin.yml b/.github/workflows/mixin.yml
index aa715ccb..ae1a12b8 100644
--- a/.github/workflows/mixin.yml
+++ b/.github/workflows/mixin.yml
@@ -1,10 +1,13 @@
 name: Mixin
 
+# The runbook check in "mise run test" reads docs/runbooks, so runbook
+# changes run this workflow too.
 on:
   pull_request:
     paths:
       - contrib/mixin/**
       - dashboard/*.json
+      - docs/runbooks/**
       - .github/workflows/mixin.yml
   push:
     branches:
@@ -14,6 +17,7 @@ on:
     paths:
       - contrib/mixin/**
       - dashboard/*.json
+      - docs/runbooks/**
       - .github/workflows/mixin.yml
   workflow_dispatch: