diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index 8da02a2..29100b5 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -12,7 +12,7 @@
 
 - [ ] `npm run check`
 - [ ] `npm test`
-- [ ] `npm run build` (required if this touches the build, `app.json`, or bridge commands)
+- [ ] `npm run build` — **not run by CI**; required if this touches the build, `app.json`, or bridge commands
 - [ ] Ran `npm run dev` and exercised the change in a real window
 
 Steps you clicked through, and what you observed:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cb88da2..b21d102 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -56,10 +56,10 @@ jobs:
         run: npm run check
 
       # `native` asks before downloading its pinned Zig toolchain, and CI has no
-      # tty to answer, so pass --yes. The first zig-needing step fetches it; the
-      # cache above keeps later runs from re-downloading.
+      # tty to answer, so pass --yes. This step fetches it on a cold cache.
+      #
+      # CI does not run `npm run build`: the ReleaseFast build dominates the run
+      # time, and `native test` already compiles the app in Debug. Run
+      # `npm run build` locally before anything that touches the build graph.
       - name: Test
         run: npm test -- --yes
-
-      - name: Build
-        run: npm run build -- --yes
diff --git a/.github/workflows/contributor-check.yml b/.github/workflows/contributor-check.yml
index 92f2364..36782fa 100644
--- a/.github/workflows/contributor-check.yml
+++ b/.github/workflows/contributor-check.yml
@@ -17,6 +17,8 @@ permissions:
 jobs:
   membership:
     name: check author membership
+    # Bots open pull requests too (Dependabot), and they are never org members.
+    if: github.event.pull_request.user.type != 'Bot'
     runs-on: ubuntu-latest
     steps:
       - name: Flag non-member pull requests
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 3ec356b..a319e74 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -51,12 +51,17 @@ pick a folder.
 ```sh
 npm run check   # markup, manifest, and core validation
 npm test        # Zig unit tests in src/main.zig
-npm run build   # release build — run for anything touching the build or manifest
+npm run build   # release build — CI does not run this, so run it yourself
 ```
 
 `check`, `test`, and `build` all regenerate `frontend/dist/tree.js` first, so run
 them before committing if you touched `frontend/tree.js`.
 
+CI runs `check` and `test` only — the ReleaseFast build is too slow to gate every
+pull request, and `native test` already compiles the app in Debug. That makes
+`npm run build` your responsibility for anything touching the build graph,
+`app.json`, or bridge commands: a release-only break will not be caught for you.
+
 ## Working in this codebase
 
 The layout, invariants, and the bridge-command checklist live in