diff --git a/.gitea/workflows/backend-ci.yml b/.gitea/workflows/backend-ci.yml
new file mode 100644
index 0000000..27df03b
--- /dev/null
+++ b/.gitea/workflows/backend-ci.yml
@@ -0,0 +1,58 @@
+name: Backend CI
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "server/**"
+      - ".gitea/workflows/backend-ci.yml"
+  pull_request:
+    branches:
+      - main
+    paths:
+      - "server/**"
+      - ".gitea/workflows/backend-ci.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  backend:
+    name: Backend
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: server/go.mod
+          cache-dependency-path: server/go.sum
+
+      - name: Add Go bin to PATH
+        run: echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
+
+      - name: Install sqlc
+        run: go install github.com/sqlc-dev/sqlc/cmd/sqlc@v1.30.0
+
+      - name: Generate sqlc code
+        working-directory: server
+        run: make sqlc-generate
+
+      - name: Verify generated code is committed
+        run: git diff --exit-code -- server/internal/tenant/repository/generated
+
+      - name: Check tenant SQL scope guard
+        working-directory: server
+        run: make tenant-scope-guard
+
+      - name: Run tests
+        working-directory: server
+        run: make test
+
+      - name: Build Go commands
+        working-directory: server
+        run: go build ./cmd/...
diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
deleted file mode 100644
index 50c64fa..0000000
--- a/.gitea/workflows/ci.yml
+++ /dev/null
@@ -1,111 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-    branches:
-      - main
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  backend:
-    name: Backend
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Setup Go
-        uses: actions/setup-go@v5
-        with:
-          go-version-file: server/go.mod
-          cache-dependency-path: server/go.sum
-
-      - name: Add Go bin to PATH
-        run: echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
-
-      - name: Install sqlc
-        run: go install github.com/sqlc-dev/sqlc/cmd/sqlc@v1.30.0
-
-      - name: Generate sqlc code
-        working-directory: server
-        run: make sqlc-generate
-
-      - name: Verify generated code is committed
-        run: git diff --exit-code -- server/internal/tenant/repository/generated
-
-      - name: Check tenant SQL scope guard
-        working-directory: server
-        run: make tenant-scope-guard
-
-      - name: Run tests
-        working-directory: server
-        run: make test
-
-      - name: Build Go commands
-        working-directory: server
-        run: go build ./cmd/...
-
-  frontend:
-    name: Frontend
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Setup Node
-        uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-
-      - name: Setup pnpm
-        run: |
-          corepack enable
-          corepack prepare pnpm@10.33.0 --activate
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Typecheck admin web
-        run: pnpm typecheck:admin
-
-      - name: Typecheck ops web
-        run: pnpm --filter ops-web typecheck
-
-      - name: Typecheck browser extension
-        run: pnpm typecheck:extension
-
-      - name: Build admin web
-        run: pnpm build:admin
-
-      - name: Build ops web
-        run: pnpm --filter ops-web build
-
-  deploy-config:
-    name: Deployment Config
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install Docker CLI
-        run: |
-          if command -v docker >/dev/null 2>&1; then
-            docker --version
-            exit 0
-          fi
-          apt-get update
-          apt-get install -y docker.io docker-compose-plugin
-
-      - name: Validate compose files
-        run: |
-          docker compose -f deploy/docker-compose.yaml config >/tmp/compose.yaml
-          docker compose -f deploy/docker-compose.yaml -f deploy/docker-compose.offline.yaml config >/tmp/compose-offline.yaml
-
-      - name: Validate shell scripts
-        run: bash -n deploy/scripts/package.sh deploy/scripts/load-and-start.sh
diff --git a/.gitea/workflows/deploy-config-ci.yml b/.gitea/workflows/deploy-config-ci.yml
new file mode 100644
index 0000000..99d2e64
--- /dev/null
+++ b/.gitea/workflows/deploy-config-ci.yml
@@ -0,0 +1,54 @@
+name: Deployment Config CI
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "deploy/**"
+      - "Dockerfile*"
+      - ".dockerignore"
+      - "server/Dockerfile"
+      - "server/.dockerignore"
+      - ".gitea/workflows/deploy-config-ci.yml"
+      - ".gitea/workflows/offline-package.yml"
+  pull_request:
+    branches:
+      - main
+    paths:
+      - "deploy/**"
+      - "Dockerfile*"
+      - ".dockerignore"
+      - "server/Dockerfile"
+      - "server/.dockerignore"
+      - ".gitea/workflows/deploy-config-ci.yml"
+      - ".gitea/workflows/offline-package.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  deploy-config:
+    name: Deployment Config
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install Docker CLI
+        run: |
+          if command -v docker >/dev/null 2>&1; then
+            docker --version
+            exit 0
+          fi
+          apt-get update
+          apt-get install -y docker.io docker-compose-plugin
+
+      - name: Validate compose files
+        run: |
+          docker compose -f deploy/docker-compose.yaml config >/tmp/compose.yaml
+          docker compose -f deploy/docker-compose.yaml -f deploy/docker-compose.offline.yaml config >/tmp/compose-offline.yaml
+
+      - name: Validate shell scripts
+        run: bash -n deploy/scripts/package.sh deploy/scripts/load-and-start.sh
diff --git a/.gitea/workflows/frontend-ci.yml b/.gitea/workflows/frontend-ci.yml
new file mode 100644
index 0000000..3e168b3
--- /dev/null
+++ b/.gitea/workflows/frontend-ci.yml
@@ -0,0 +1,63 @@
+name: Frontend CI
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "apps/**"
+      - "packages/**"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - ".gitea/workflows/frontend-ci.yml"
+  pull_request:
+    branches:
+      - main
+    paths:
+      - "apps/**"
+      - "packages/**"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - ".gitea/workflows/frontend-ci.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  frontend:
+    name: Frontend
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+
+      - name: Setup pnpm
+        run: |
+          corepack enable
+          corepack prepare pnpm@10.33.0 --activate
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Typecheck admin web
+        run: pnpm typecheck:admin
+
+      - name: Typecheck ops web
+        run: pnpm --filter ops-web typecheck
+
+      - name: Typecheck browser extension
+        run: pnpm typecheck:extension
+
+      - name: Build admin web
+        run: pnpm build:admin
+
+      - name: Build ops web
+        run: pnpm --filter ops-web build