diff --git a/.github/workflows/containerbuild.yml b/.github/workflows/containerbuild.yml
index a67f602f94..234c00768e 100644
--- a/.github/workflows/containerbuild.yml
+++ b/.github/workflows/containerbuild.yml
@@ -15,24 +15,35 @@ permissions:
   packages: write
 
 jobs:
-  pre_postgres:
-    name: Path match check - postgres
+  pre_job:
+    name: Path match check
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
     # Map a step output to a job output
     outputs:
-      should_skip: ${{ steps.skip_check.outputs.should_skip }}
+      postgres: ${{ steps.filter.outputs.postgres }}
+      nginx: ${{ steps.filter.outputs.nginx }}
     steps:
-      - id: skip_check
-        uses: fkirc/skip-duplicate-actions@master
+      # paths-filter needs a checkout to diff push events
+      - uses: actions/checkout@v7
+      - id: filter
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         with:
-          skip_after_successful_duplicate: false
-          github_token: ${{ github.token }}
-          paths: '["docker/Dockerfile.postgres.dev", ".github/workflows/containerbuild.yml"]'
+          filters: |
+            postgres:
+              - 'docker/Dockerfile.postgres.dev'
+              - '.github/workflows/containerbuild.yml'
+            nginx:
+              - 'docker/Dockerfile.nginx.prod'
+              - 'docker/nginx/*'
+              - '.github/workflows/containerbuild.yml'
 
   build_and_push_postgres:
     name: Postgres - build and push Docker image to GitHub Container Registry
-    needs: pre_postgres
-    if: ${{ needs.pre_postgres.outputs.should_skip != 'true' }}
+    needs: pre_job
+    if: ${{ github.ref_type == 'tag' || needs.pre_job.outputs.postgres == 'true' }}
     runs-on: ubuntu-latest
     steps:
     - name: Checkout codebase
@@ -71,24 +82,10 @@ jobs:
         labels: ${{ steps.meta.outputs.labels }}
         annotations: ${{ steps.meta.outputs.annotations }}
 
-  pre_nginx:
-    name: Path match check - nginx
-    runs-on: ubuntu-latest
-    # Map a step output to a job output
-    outputs:
-      should_skip: ${{ steps.skip_check.outputs.should_skip }}
-    steps:
-      - id: skip_check
-        uses: fkirc/skip-duplicate-actions@master
-        with:
-          skip_after_successful_duplicate: false
-          github_token: ${{ github.token }}
-          paths: '["docker/Dockerfile.nginx.prod", "docker/nginx/*", ".github/workflows/containerbuild.yml"]'
-
   build_nginx:
     name: nginx - test build of nginx Docker image
-    needs: pre_nginx
-    if: ${{ needs.pre_nginx.outputs.should_skip != 'true' }}
+    needs: pre_job
+    if: ${{ github.ref_type == 'tag' || needs.pre_job.outputs.nginx == 'true' }}
     runs-on: ubuntu-latest
     steps:
     - name: Checkout codebase
diff --git a/.github/workflows/deploytest.yml b/.github/workflows/deploytest.yml
index dbcf95e2e7..ba1e8ce0fc 100644
--- a/.github/workflows/deploytest.yml
+++ b/.github/workflows/deploytest.yml
@@ -10,25 +10,36 @@ on:
 
 permissions:
   contents: read
-  actions: read
 
 jobs:
   pre_job:
     name: Path match check
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
     # Map a step output to a job output
     outputs:
-      should_skip: ${{ steps.skip_check.outputs.should_skip }}
+      deploy: ${{ steps.filter.outputs.deploy }}
     steps:
-      - id: skip_check
-        uses: fkirc/skip-duplicate-actions@master
+      # paths-filter needs a checkout to diff push events
+      - uses: actions/checkout@v7
+      - id: filter
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         with:
-          github_token: ${{ github.token }}
-          paths: '["**.py", "requirements.txt", ".github/workflows/deploytest.yml", "**.vue", "**.js", "pnpm-lock.yaml", "package.json"]'
+          filters: |
+            deploy:
+              - '**.py'
+              - 'requirements.txt'
+              - '.github/workflows/deploytest.yml'
+              - '**.vue'
+              - '**.js'
+              - 'pnpm-lock.yaml'
+              - 'package.json'
   build_assets:
     name: Build frontend assets
     needs: pre_job
-    if: ${{ needs.pre_job.outputs.should_skip != 'true' }}
+    if: ${{ needs.pre_job.outputs.deploy == 'true' }}
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v7
@@ -57,7 +68,7 @@ jobs:
   make_messages:
     name: Build all message files
     needs: pre_job
-    if: ${{ needs.pre_job.outputs.should_skip != 'true' }}
+    if: ${{ needs.pre_job.outputs.deploy == 'true' }}
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v7
@@ -91,7 +102,7 @@ jobs:
   browser_smoke_test:
     name: Browser smoke test
     needs: [pre_job, build_assets]
-    if: ${{ needs.pre_job.outputs.should_skip != 'true' }}
+    if: ${{ needs.pre_job.outputs.deploy == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 10
     services:
diff --git a/.github/workflows/frontendtest.yml b/.github/workflows/frontendtest.yml
index bf0db94485..c3eb5e9db0 100644
--- a/.github/workflows/frontendtest.yml
+++ b/.github/workflows/frontendtest.yml
@@ -10,25 +10,32 @@ on:
 
 permissions:
   contents: read
-  actions: read
 
 jobs:
   pre_job:
     name: Path match check
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
     # Map a step output to a job output
     outputs:
-      should_skip: ${{ steps.skip_check.outputs.should_skip }}
+      frontend: ${{ steps.filter.outputs.frontend }}
     steps:
-      - id: skip_check
-        uses: fkirc/skip-duplicate-actions@master
+      # paths-filter needs a checkout to diff push events
+      - uses: actions/checkout@v7
+      - id: filter
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         with:
-          github_token: ${{ github.token }}
-          paths: '["**.vue", "**.js", "pnpm-lock.yaml"]'
+          filters: |
+            frontend:
+              - '**.vue'
+              - '**.js'
+              - 'pnpm-lock.yaml'
   test:
     name: Frontend tests
     needs: pre_job
-    if: ${{ needs.pre_job.outputs.should_skip != 'true' }}
+    if: ${{ needs.pre_job.outputs.frontend == 'true' }}
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v7
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 9781ffcec8..d1efce139a 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -19,19 +19,28 @@ jobs:
   pre_job:
     name: Path match check
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
     # Map a step output to a job output
     outputs:
-      should_skip: ${{ steps.skip_check.outputs.should_skip }}
+      lint: ${{ steps.filter.outputs.lint }}
     steps:
-      - id: skip_check
-        uses: fkirc/skip-duplicate-actions@master
+      # paths-filter needs a checkout to diff push events
+      - uses: actions/checkout@v7
+      - id: filter
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         with:
-          github_token: ${{ github.token }}
-          paths_ignore: '["**.po", "**.json"]'
+          predicate-quantifier: every
+          # Not '!**.po': picomatch applies that negation at the repo root only.
+          filters: |
+            lint:
+              - '!**/*.po'
+              - '!**/*.json'
   linting:
     name: All file linting
     needs: pre_job
-    if: ${{ needs.pre_job.outputs.should_skip != 'true' }}
+    if: ${{ needs.pre_job.outputs.lint == 'true' }}
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v7
diff --git a/.github/workflows/pythontest.yml b/.github/workflows/pythontest.yml
index cbf3dbb1c4..4bee416997 100644
--- a/.github/workflows/pythontest.yml
+++ b/.github/workflows/pythontest.yml
@@ -10,26 +10,36 @@ on:
 
 permissions:
   contents: read
-  actions: read
 
 jobs:
   pre_job:
     name: Path match check
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
     # Map a step output to a job output
     outputs:
-      should_skip: ${{ steps.skip_check.outputs.should_skip }}
+      python: ${{ steps.filter.outputs.python }}
     steps:
-      - id: skip_check
-        uses: fkirc/skip-duplicate-actions@master
+      # paths-filter needs a checkout to diff push events
+      - uses: actions/checkout@v7
+      - id: filter
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         with:
-          github_token: ${{ github.token }}
-          paths: '["**.py", "requirements.txt", "requirements-dev.txt", ".github/workflows/pythontest.yml", "webpack.config.js", "webpackDevServerAddress.js"]'
+          filters: |
+            python:
+              - '**.py'
+              - 'requirements.txt'
+              - 'requirements-dev.txt'
+              - '.github/workflows/pythontest.yml'
+              - 'webpack.config.js'
+              - 'webpackDevServerAddress.js'
 
   unit_test:
     name: Python unit tests
     needs: pre_job
-    if: ${{ needs.pre_job.outputs.should_skip != 'true' }}
+    if: ${{ needs.pre_job.outputs.python == 'true' }}
     runs-on: ubuntu-latest
 
     services: