diff --git a/.github/workflows/pr-iphone-deploy.yml b/.github/workflows/pr-iphone-deploy.yml
index 4021695..65f4802 100644
--- a/.github/workflows/pr-iphone-deploy.yml
+++ b/.github/workflows/pr-iphone-deploy.yml
@@ -8,12 +8,11 @@ on:
   pull_request:
     branches: [main]
     types: [opened, synchronize, reopened]
-    # Only run the iOS build+deploy when the PR actually touches the Swift app
-    # or this workflow itself. Docs-only / backend-only / admin-web-only PRs
-    # skip the runner entirely (no point rebuilding an unchanged .app).
-    paths:
-      - 'tabatago-swift/**'
-      - '.github/workflows/pr-iphone-deploy.yml'
+    # NOTE: no trigger-level `paths:` here — Gitea Actions does not reliably
+    # honor `on.pull_request.paths:` filters (the workflow silently fails to
+    # trigger even when changed files match). Path gating is done at the job
+    # level via dorny/paths-filter@v3 in the `changes` job below (same pattern
+    # as ci.yml). Docs/backend-only PRs then skip the macOS runner.
 
 # Every mutation (comments, merge) goes through the Gitea API with PR_API_TOKEN,
 # never the runner's native GITHUB_TOKEN — so a `permissions:` block would be
@@ -26,8 +25,29 @@ concurrency:
 
 jobs:
 
+  # ── Path filter — determines whether the macOS build+deploy is worth running ──
+  # Gitea Actions does not honor trigger-level `on.pull_request.paths:`, so we
+  # gate at the job level with dorny/paths-filter (same pattern as ci.yml).
+  changes:
+    name: Detect Changes
+    runs-on: ubuntu-latest
+    outputs:
+      ios: ${{ steps.filter.outputs.ios }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dorny/paths-filter@v3
+        id: filter
+        with:
+          filters: |
+            ios:
+              - 'tabatago-swift/**'
+              - '.github/workflows/pr-iphone-deploy.yml'
+
   build-deploy:
     name: Build & Deploy to iPhone (devicectl)
+    needs: changes
+    if: needs.changes.outputs.ios == 'true'
     runs-on: macos
     timeout-minutes: 30
 
@@ -187,6 +207,10 @@ jobs:
   wait-approval:
     name: Wait for LGTM comment
     needs: build-deploy
+    # Only run when build-deploy actually deployed. Without this, a skipped
+    # build-deploy (filtered out by `changes`) would still launch this job and
+    # the merge poll would run against a PR that was never deployed to device.
+    if: needs.build-deploy.result == 'success'
     runs-on: macos
     timeout-minutes: 120