diff --git a/.github/workflows/gh-cache.yml b/.github/workflows/gh-cache.yml
index 0b8d2b5685134..62f0f848e7a9f 100644
--- a/.github/workflows/gh-cache.yml
+++ b/.github/workflows/gh-cache.yml
@@ -3,6 +3,9 @@ name: GitHub Cache
 on:
   push:
     branches: [trunk]
+    # Browser pins (common/repositories.bzl, common/browsers.bzl) are deliberately
+    # absent: this job populates with --pin_browsers=false, so those repositories
+    # are never fetched and a run triggered by them has nothing new to cache.
     paths:
       - 'MODULE.bazel'
       - 'multitool.lock.json'
@@ -12,8 +15,6 @@ on:
       - 'py/requirements_lock.txt'
       - 'rb/Gemfile.lock'
       - 'dotnet/paket.lock'
-      - 'common/repositories.bzl'
-      - 'common/browsers.bzl'
   schedule:
     - cron: '30 6 * * *'
   workflow_dispatch:
diff --git a/.github/workflows/prune-caches.yml b/.github/workflows/prune-caches.yml
index f1b275c24aa2f..04a05438db96b 100644
--- a/.github/workflows/prune-caches.yml
+++ b/.github/workflows/prune-caches.yml
@@ -2,9 +2,10 @@ name: Prune CodeQL caches
 
 on:
   workflow_run:
+    # No branch filter: CodeQL runs mostly from pull requests, and those caches
+    # count against the same 10 GiB repo budget as the trunk ones.
     workflows: ["CodeQL"]
     types: [completed]
-    branches: [trunk]
   workflow_dispatch:
 
 concurrency: