diff --git a/.github/config/.files.yaml b/.github/config/.files.yaml
index b5cc0527b0..7804506535 100644
--- a/.github/config/.files.yaml
+++ b/.github/config/.files.yaml
@@ -8,6 +8,7 @@ ci: &ci
 
 build: &build
   - *ci
+  - buildSrc/**
   - build.gradle
   - gradle/spotless.gradle
   - app/(common|core|proprietary|saas)/build.gradle
@@ -15,6 +16,22 @@ build: &build
   - .taskfiles/backend.yml
   - .github/workflows/check-licence.yml
 
+# Backend build inputs. This is intentionally broader than `build`: Java and
+# backend resource changes must exercise the backend matrix even when Gradle
+# build scripts themselves are unchanged.
+backend: &backend
+  - *ci
+  - *build
+  - gradle/**
+  - gradle.properties
+  - gradlew
+  - gradlew.bat
+  - settings.gradle
+  - app/(common|core|proprietary|saas)/src/(main|test)/java/**
+  - "app/(common|core|proprietary|saas)/src/(main|test)/resources/**/!(messages_*.properties|*.md)*"
+  - scripts/db-migration/**
+  - .github/workflows/backend-build.yml
+
 openapi: &openapi
   - *ci
   - *build
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1feaff2560..631102bf9a 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -37,6 +37,7 @@ jobs:
     timeout-minutes: 3
     outputs:
       build: ${{ steps.changes.outputs.build }}
+      backend: ${{ steps.changes.outputs.backend }}
       project: ${{ steps.changes.outputs.project }}
       openapi: ${{ steps.changes.outputs.openapi }}
       frontend: ${{ steps.changes.outputs.frontend }}
@@ -65,6 +66,7 @@ jobs:
       name: ci-unsigned
       deployment: false
     name: Prime shared Gradle cache
+    if: needs.files-changed.outputs.project == 'true'
     needs: [files-changed]
     runs-on: ubuntu-latest
     timeout-minutes: 15
@@ -118,6 +120,7 @@ jobs:
           key: ${{ steps.gradle-cache-key.outputs.key }}
 
   build:
+    if: needs.files-changed.outputs.backend == 'true'
     needs: [files-changed, gradle-cache-prime]
     permissions:
       actions: read
@@ -196,7 +199,7 @@ jobs:
 
   check-licence:
     if: needs.files-changed.outputs.build == 'true'
-    needs: [files-changed, build, gradle-cache-prime]
+    needs: [files-changed, gradle-cache-prime]
     permissions:
       contents: read
     uses: ./.github/workflows/check-licence.yml
@@ -215,7 +218,14 @@ jobs:
       docker-base-changed: ${{ needs.files-changed.outputs.docker-base }}
 
   test-build-docker-images:
-    if: github.event_name == 'pull_request' && needs.files-changed.outputs.project == 'true'
+    if: |
+      always() &&
+      github.event_name == 'pull_request' &&
+      needs.files-changed.outputs.project == 'true' &&
+      contains(fromJSON('["success", "skipped"]'), needs.gradle-cache-prime.result) &&
+      contains(fromJSON('["success", "skipped"]'), needs.build.result) &&
+      contains(fromJSON('["success", "skipped"]'), needs.check-generateOpenApiDocs.result) &&
+      contains(fromJSON('["success", "skipped"]'), needs.check-licence.result)
     needs:
       [
         files-changed,
@@ -321,6 +331,7 @@ jobs:
     if: always()
     needs:
       - files-changed
+      - gradle-cache-prime
       - build
       - db-migration-test
       - check-generateOpenApiDocs
@@ -348,6 +359,7 @@ jobs:
         env:
           RESULTS: |
             files-changed=${{ needs.files-changed.result }}
+            gradle-cache-prime=${{ needs.gradle-cache-prime.result }}
             build=${{ needs.build.result }}
             db-migration-test=${{ needs.db-migration-test.result }}
             check-generateOpenApiDocs=${{ needs.check-generateOpenApiDocs.result }}