diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 00a19f512bc6..54fed01215bb 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -29,12 +29,22 @@ jobs:
     outputs:
       src: ${{ steps.filter.outputs.src }}
       ci: ${{ steps.filter.outputs.ci }}
+      # runnable is true if there are changes outside the .github/workflows directory OR if ci.yaml itself (or kokoro scripts) is modified.
+      runnable: ${{ fromJSON(steps.filter.outputs.all_count) > fromJSON(steps.filter.outputs.workflows_count) || fromJSON(steps.filter.outputs.ci_count) > 0 }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
+      # Use this action, rather than a file filter so that we can make this
+      # mandatory.
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#example-including-branches
+      # for more details.
     - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
       id: filter
       with:
         filters: |
+          all:
+            - '**'
+          workflows:
+            - '.github/workflows/**'
           src:
             - '!(google-auth-library-java|grpc-gcp-java|java-bigquery|java-bigquery-jdbc|java-bigquerystorage|java-bigtable|java-datastore|java-firestore|java-logging|java-logging-logback|java-pubsub|java-spanner|java-storage)/**/*.java'
             - '!(google-auth-library-java|grpc-gcp-java|java-bigquery|java-bigquery-jdbc|java-bigquerystorage|java-bigtable|java-datastore|java-firestore|java-logging|java-logging-logback|java-pubsub|java-spanner|java-storage)/**/pom.xml'
@@ -46,6 +56,7 @@ jobs:
   units:
     runs-on: ubuntu-latest
     needs: bulk-filter
+    if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
     strategy:
       fail-fast: false
       matrix:
@@ -73,6 +84,7 @@ jobs:
   units-8-runtime:
     runs-on: ubuntu-latest
     needs: bulk-filter
+    if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
     name: "units (8)"
     steps:
     - name: Get current week within the year
@@ -106,13 +118,15 @@ jobs:
         JOB_NAME: units-8-runtime-${{matrix.java}}
   # detect which libraries have changed
   changes:
+    needs: bulk-filter
+    if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
     runs-on: ubuntu-latest
     permissions:
       pull-requests: read
     outputs:
       packages: ${{ steps.filter.outputs.changes }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
       id: filter
       with:
@@ -302,7 +316,7 @@ jobs:
       env:
         BUILD_SUBDIR: ${{matrix.package}}
   required:
-    needs: [ changes, split-units, split-clirr, split-dependencies ]
+    needs: [ bulk-filter, changes, split-units, split-clirr, split-dependencies ]
     name: conditional-required-check
     if: ${{ always() }} # Always run even if any "needs" jobs fail
     runs-on: ubuntu-22.04
@@ -313,6 +327,8 @@ jobs:
       - name: Success otherwise
         run: echo "Success!"
   windows:
+    needs: bulk-filter
+    if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
     runs-on: windows-latest
     steps:
     - name: Support longpaths
@@ -329,6 +345,8 @@ jobs:
         JOB_TYPE: test
         JOB_NAME: windows-units
   lint:
+    needs: bulk-filter
+    if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
@@ -345,6 +363,8 @@ jobs:
         HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
         BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
   enforcer:
+    needs: bulk-filter
+    if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
     runs-on: ubuntu-latest
     steps:
     - name: Get current week within the year
@@ -364,6 +384,8 @@ jobs:
     - run: java -version
     - run: mvn -B -ntp enforcer:enforce@enforce -T 1C
   gapic-libraries-bom:
+    needs: bulk-filter
+    if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
@@ -381,6 +403,8 @@ jobs:
       with:
         bom-path: gapic-libraries-bom/pom.xml
   generation-config-check:
+    needs: bulk-filter
+    if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4