diff --git a/.github/workflows/tutorial_docker.yaml b/.github/workflows/tutorial_docker.yaml
index 830694cce8..c4a86c2295 100644
--- a/.github/workflows/tutorial_docker.yaml
+++ b/.github/workflows/tutorial_docker.yaml
@@ -6,6 +6,20 @@ on:
     - cron:  '0 17 * * 6'
   workflow_dispatch:
   pull_request:
+    # This job rebuilds moveit2 + moveit2_tutorials + upstream deps from source
+    # and takes 45-60 min, so skip PRs that cannot affect the tutorial image.
+    # `paths` with `!` rather than `paths-ignore`, because negation is only
+    # supported in `paths` and the two cannot be combined for one event.
+    # Order matters: later patterns override earlier ones.
+    paths:
+      - '**'
+      - '!**/test/**'
+      - '!**/*.test.py'
+      - '!**.md'
+      - '!.github/**'
+      - '.github/workflows/tutorial_docker.yaml'
+      - '!.docker/**'
+      - '.docker/tutorial-source/**'
   merge_group:
   push:
     branches:
@@ -49,7 +63,15 @@ jobs:
         uses: actions/cache@v5
         with:
           path: .ccache
-          key: docker-tutorial-ccache-${{ matrix.ROS_DISTRO }}-${{ hashFiles( '.docker/tutorial-source/Dockerfile' ) }}
+          # actions/cache skips its save step on an exact-key hit, so a static key
+          # is written once and never refreshed -- every later build reuses a
+          # frozen ccache. Make the key unique per run and fall back to the
+          # stable prefix, so each run restores the newest entry and saves an
+          # updated one.
+          key: docker-tutorial-ccache-${{ matrix.ROS_DISTRO }}-${{ hashFiles( '.docker/tutorial-source/Dockerfile' ) }}-${{ github.run_id }}
+          restore-keys: |
+            docker-tutorial-ccache-${{ matrix.ROS_DISTRO }}-${{ hashFiles( '.docker/tutorial-source/Dockerfile' ) }}-
+            docker-tutorial-ccache-${{ matrix.ROS_DISTRO }}-
       - name: inject ccache into docker
         uses: reproducible-containers/buildkit-cache-dance@v3.3.0
         with: