diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index 1accab99..301f8776 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -7,7 +7,7 @@ on:
       - 'docs/**'
       - 'mkdocs.yml'
       - 'requirements-docs.txt'
-      - '*.md'
+      - '**/*.md'
   workflow_dispatch:
 
 jobs:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ac0a4ff8..a4d268d4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,14 +7,14 @@ on:
       - 'docs/**'
       - 'mkdocs.yml'
       - 'requirements-docs.txt'
-      - '*.md'
+      - '**/*.md'
   pull_request:
     branches: [main]
     paths-ignore:
       - 'docs/**'
       - 'mkdocs.yml'
       - 'requirements-docs.txt'
-      - '*.md'
+      - '**/*.md'
 
 jobs:
   build:
@@ -24,6 +24,7 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: '3.11'
+          cache: 'pip'
       - run: pip install build
       - run: python -m build
       - run: pip install -e ".[dev]"
diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 3e117393..e4581e6e 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -9,14 +9,14 @@ on:
       - 'docs/**'
       - 'mkdocs.yml'
       - 'requirements-docs.txt'
-      - '*.md'
+      - '**/*.md'
   pull_request:
     branches: [main]
     paths-ignore:
       - 'docs/**'
       - 'mkdocs.yml'
       - 'requirements-docs.txt'
-      - '*.md'
+      - '**/*.md'
 
 jobs:
   security-scan:
@@ -168,7 +168,7 @@ jobs:
             }
             
             // Create summary comment
-            const comment = `# 🔒 Security Scan Results\\n\\n${safetyResults}\\n\\n${banditResults}\\n\\n${semgrepResults}\\n\\n---\\n\\n*This security scan runs automatically on every PR and bi-weekly.*\\n\\n📊 **Security Policy**: CI fails on vulnerabilities and HIGH severity issues.`;
+            const comment = `# 🔒 Security Scan Results\\n\\n${safetyResults}\\n\\n${banditResults}\\n\\n${semgrepResults}\\n\\n---\\n\\n*This security scan runs automatically on source-code PRs and bi-weekly (skipped for doc/markdown-only changes).*\\n\\n📊 **Security Policy**: CI fails on vulnerabilities and HIGH severity issues.`;
             
             // Post comment with error handling
             try {