diff --git a/.github/workflows/builds.yml b/.github/workflows/builds.yml
index 1d527737c..0214386b4 100644
--- a/.github/workflows/builds.yml
+++ b/.github/workflows/builds.yml
@@ -15,18 +15,7 @@
 name: Builds
 
 on:
-  push:
-    branches: ["main"]
-  pull_request:
-    branches: ["main"]
-    paths-ignore:
-      - "**/*.md"
-      - ".changeset/**"
-      - "LICENSE"
-      - "NOTICE"
-      - "renovate.json"
-      - ".vscode/**"
-  workflow_dispatch:
+  workflow_call:
 
 env:
   CARGO_TERM_COLOR: always
diff --git a/.github/workflows/changeset-check.yml b/.github/workflows/changeset-check.yml
index d6e99072e..d6806a263 100644
--- a/.github/workflows/changeset-check.yml
+++ b/.github/workflows/changeset-check.yml
@@ -15,9 +15,7 @@
 name: Changeset Check
 
 on:
-  pull_request:
-    types: [opened, synchronize, labeled, unlabeled]
-    branches: [main]
+  workflow_call:
 
 permissions:
   contents: read
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 000000000..ed96b6331
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,92 @@
+name: CI
+
+on:
+  workflow_dispatch:
+  pull_request:
+    types: [opened, reopened, synchronize, ready_for_review, labeled, unlabeled]
+    branches: [main]
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  changes:
+    name: Detect Changes
+    runs-on: ubuntu-latest
+    outputs:
+      core: ${{ steps.filter.outputs.core }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
+        id: filter
+        with:
+          # Match the existing build/test path exclusions. Formatting, API, and
+          # license checks remain broad, as they are today.
+          predicate-quantifier: some-with-excludes
+          filters: |
+            core:
+              - '**'
+              - '!**/*.md'
+              - '!.changeset/**'
+              - '!LICENSE'
+              - '!NOTICE'
+              - '!renovate.json'
+              - '!.vscode/**'
+
+  formatting:
+    name: Formatting
+    if: ${{ github.event.action != 'labeled' && github.event.action != 'unlabeled' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || !github.event.pull_request.draft) }}
+    uses: ./.github/workflows/format.yml
+
+  builds:
+    name: Builds
+    needs: changes
+    if: ${{ github.event.action != 'labeled' && github.event.action != 'unlabeled' && (needs.changes.outputs.core == 'true' || github.event_name == 'workflow_dispatch') }}
+    uses: ./.github/workflows/builds.yml
+
+  tests:
+    name: Tests
+    needs: changes
+    if: ${{ github.event.action != 'labeled' && github.event.action != 'unlabeled' && (needs.changes.outputs.core == 'true' || github.event_name == 'workflow_dispatch') }}
+    uses: ./.github/workflows/tests.yml
+
+  test-api:
+    name: Test API
+    if: ${{ github.event.action != 'labeled' && github.event.action != 'unlabeled' }}
+    uses: ./.github/workflows/test-api.yml
+
+  license-check:
+    name: License Check
+    if: ${{ github.event.action != 'labeled' && github.event.action != 'unlabeled' }}
+    uses: ./.github/workflows/license-check.yml
+
+  changeset:
+    name: Changeset Check
+    if: ${{ github.event_name == 'pull_request' }}
+    permissions:
+      contents: read
+      pull-requests: write
+    uses: ./.github/workflows/changeset-check.yml
+
+  # Repository rulesets should require only this job. It succeeds when a
+  # conditionally skipped workflow is not relevant to the change.
+  ci:
+    name: CI
+    runs-on: ubuntu-latest
+    needs:
+      - changes
+      - formatting
+      - builds
+      - tests
+      - test-api
+      - license-check
+      - changeset
+    if: always()
+    steps:
+      - name: Verify required CI jobs
+        uses: suzuki-shunsuke/required-status-check-action@2b5a46064846b09381852c2c4217e898f639e768 # v0.1.3
+        with:
+          needs: ${{ toJson(needs) }}
diff --git a/.github/workflows/format.yml b/.github/workflows/format.yml
index 9c364ecb8..582db8b5d 100644
--- a/.github/workflows/format.yml
+++ b/.github/workflows/format.yml
@@ -1,16 +1,7 @@
 name: Rust Formatting
 
 on:
-  workflow_dispatch:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-    types:
-      - opened
-      - reopened
-      - synchronize
-      - ready_for_review
+  workflow_call:
 
 env:
   CARGO_TERM_COLOR: always
@@ -19,7 +10,6 @@ jobs:
   formatting:
     name: Check Formatting
     runs-on: ubuntu-latest
-    if: github.event_name == 'push' || !github.event.pull_request.draft
 
     steps:
       - name: Checkout the repo
diff --git a/.github/workflows/license-check.yml b/.github/workflows/license-check.yml
index 7d4e02e29..16d29f353 100644
--- a/.github/workflows/license-check.yml
+++ b/.github/workflows/license-check.yml
@@ -1,15 +1,6 @@
 name: License Check
 on:
-  workflow_dispatch:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-    types:
-      - opened
-      - reopened
-      - synchronize
-      - ready_for_review
+  workflow_call:
 jobs:
   license-check:
     name: License Check
diff --git a/.github/workflows/test-api.yml b/.github/workflows/test-api.yml
index 9f22e29c7..80007b390 100644
--- a/.github/workflows/test-api.yml
+++ b/.github/workflows/test-api.yml
@@ -18,11 +18,7 @@ permissions:
   contents: read
 
 on:
-  workflow_dispatch:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
+  workflow_call:
 
 jobs:
   # Each leg pins its feature set via --no-default-features so a regression in a
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 99d26cd73..8006164e1 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -15,20 +15,7 @@
 name: Tests
 
 on:
-  push:
-    branches: ["main"]
-  pull_request:
-    branches: ["main"]
-    # Skip the test matrix for changes that can't possibly affect Rust
-    # compilation/tests (docs, changesets, license/notice, dependabot config).
-    # Source-only changes still trigger normally.
-    paths-ignore:
-      - "**/*.md"
-      - ".changeset/**"
-      - "LICENSE"
-      - "NOTICE"
-      - "renovate.json"
-      - ".vscode/**"
+  workflow_call:
 
 env:
   CARGO_TERM_COLOR: always