diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 08052f23..346cdcfb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -67,14 +67,37 @@ jobs:
         working-directory: frontend
         run: pnpm run typescript
 
+      # Only when a codegen input moved. The lockfile is included on purpose: a codegen
+      # version bump can change the output, and skipping it there would let types.ts go
+      # stale and fail the next schema push for something its author did not do.
+      # When the range can't be resolved (new branch, force-push, tag), check anyway.
+      - name: Frontend - Detect GraphQL codegen input changes
+        id: codegen-inputs
+        run: |
+          base='${{ github.event.before }}'
+          if [ -z "$base" ] || [ "$base" = "0000000000000000000000000000000000000000" ] \
+             || ! git cat-file -e "$base^{commit}" 2>/dev/null; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          if git diff --name-only "$base" "${{ github.sha }}" | grep -qE '^(backend/pkg/graph/schema\.graphqls|frontend/graphql-schema\.graphql|frontend/graphql-codegen\.ts|frontend/pnpm-lock\.yaml)$'; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          fi
+
       # The app ships the operations compiled into src/graphql/types.ts; regenerate and
       # diff so it can't drift from graphql-schema.graphql (the codegen input the stand's
       # schema-compat pre-flight validates against).
       - name: Frontend - GraphQL codegen is fresh
+        if: steps.codegen-inputs.outputs.changed == 'true'
         working-directory: frontend
         run: |
           pnpm run graphql:generate
-          git diff --exit-code src/graphql/types.ts
+          git diff --exit-code src/graphql/types.ts || {
+            echo "::error file=frontend/src/graphql/types.ts::src/graphql/types.ts is stale — run 'pnpm run graphql:generate' in frontend/ and commit the result"
+            exit 1
+          }
 
       - name: Frontend - Test
         working-directory: frontend