diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 00000000..2653c48b
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,31 @@
+# Build artifacts and node_modules — never useful inside the Docker context.
+**/.git
+**/.gitignore
+**/node_modules
+**/.svelte-kit
+**/build
+web/build
+
+# Flutter mobile client — built separately on developer machines / Flutter CI.
+# Including it in the Go build context wastes ~70 files and invalidates the
+# `COPY . .` layer cache on every Flutter-only change.
+flutter_client/
+
+# Docs and IDE noise
+docs/
+**/.idea
+**/.vscode
+**/.DS_Store
+
+# Test outputs
+**/coverage
+**/.nyc_output
+
+# Local env / secrets — fail closed.
+.env
+.env.*
+!.env.example
+
+# CI workflow files don't need to ship in the image.
+.forgejo/
+.github/
diff --git a/.forgejo/workflows/release.yml b/.forgejo/workflows/release.yml
index abf2c715..13ebe16d 100644
--- a/.forgejo/workflows/release.yml
+++ b/.forgejo/workflows/release.yml
@@ -10,6 +10,14 @@ on:
   push:
     branches: [main]
     tags: ['v*']
+    # Tag pushes still build (tag releases are intentional, server + Flutter
+    # share the version). Branch pushes skip when the diff is Flutter-only —
+    # rebuilding the Go image for a Flutter-only merge wastes CI and churns
+    # the registry.
+    paths-ignore:
+      - 'flutter_client/**'
+      - 'docs/**'
+      - '**/*.md'
   workflow_dispatch:
 
 jobs:
diff --git a/.forgejo/workflows/test.yml b/.forgejo/workflows/test.yml
index 3b03fd54..f840fd91 100644
--- a/.forgejo/workflows/test.yml
+++ b/.forgejo/workflows/test.yml
@@ -8,8 +8,15 @@ on:
   # CI on their own — opening a PR fires the pull_request event and gates
   # the merge. Avoids the duplicate push+pull_request runs we were
   # accumulating on every PR commit.
+  #
+  # paths-ignore skips this workflow when only Flutter-client files change;
+  # the Flutter workflow (.forgejo/workflows/flutter.yml) handles those.
   pull_request:
     branches: [main]
+    paths-ignore:
+      - 'flutter_client/**'
+      - 'docs/**'
+      - '**/*.md'
 
 jobs:
   test: