diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 086a9b00..540f2971 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -100,14 +100,17 @@ jobs:
               - '.github/workflows/**'
               - 'packages/**'
             # #692: the installer integration test (real Keeper + 2x2 ClickHouse
-            # cluster in Docker). The installer, its tests, and the workflow.
+            # cluster in Docker, ~5 min per image). Deliberately narrow: only the
+            # shipped installer files, the harness, and this workflow. SPA
+            # source, deps (package.json), Caddy/Helm/k8s, and the unit-level
+            # installer tests (covered by the `test` job) do not trigger it.
             deploy:
-              - 'deploy/**'
+              - 'deploy/install.sh'
+              - 'deploy/uninstall.sh'
+              - 'deploy/lib/**'
+              - 'deploy/http_handlers.xml'
               - 'tests/deploy/**'
-              - 'tests/helpers/deploy-*'
-              - 'tests/unit/*-script.test.js'
-              - 'package.json'
-              - '.github/workflows/**'
+              - '.github/workflows/ci.yml'
             docker:
               - 'Dockerfile'
               - 'deploy/caddy/**'
@@ -427,11 +430,14 @@ jobs:
   # /sql and /sql/config.json serve after install, upgrade, repair, partial
   # failure, and uninstall. Matrix over the supported server flavours; pin exact
   # tags so a moving image cannot turn this red unrelated to the diff.
+  # Runs only on PRs touching the installer (see the `deploy` filter), release
+  # tags, and manual dispatch — not on every push to main, and not nightly:
+  # the images are pinned, so an unchanged installer cannot drift.
   deploy-integration:
     needs: changes
     if: >-
-      github.event_name == 'push' ||
       github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')) ||
       (github.event_name == 'pull_request' && needs.changes.outputs.deploy == 'true')
     runs-on: ubuntu-latest
     timeout-minutes: 30
diff --git a/.wiki/Deployment-and-Security.md b/.wiki/Deployment-and-Security.md
index 02b4e6e6..b0d04a27 100644
--- a/.wiki/Deployment-and-Security.md
+++ b/.wiki/Deployment-and-Security.md
@@ -16,7 +16,10 @@ the target of a remote-source statement). Needs a cluster `<secret>` and the
 documented minimal grants. `npm run test:deploy` (`tests/deploy/`, CI job
 `deploy-integration`) runs it against Keeper + 2x2 ClickHouse on exact tags
 (26.3.18.32, Antalya 25.8.33) and asserts byte-exact files on every node,
-including a node killed mid-run. The release bundle ships `deploy/` (install.sh,
+including a node killed mid-run. The job runs only on PRs that touch the
+installer files (`deploy/install.sh`, `uninstall.sh`, `lib/`,
+`http_handlers.xml`), `tests/deploy/`, or `ci.yml`, plus release tags and
+manual dispatch — never for SPA-only changes or on every push to `main`. The release bundle ships `deploy/` (install.sh,
 uninstall.sh, lib/) for use with `--artifact`. One installer at a time (no lock);
 `--ddl-timeout` must be >= 1; the password reaches only `clickhouse-client`.