diff --git a/.woodpecker/pr-build.yaml b/.woodpecker/pr-build.yaml
index 13c1d8b..6bf9606 100644
--- a/.woodpecker/pr-build.yaml
+++ b/.woodpecker/pr-build.yaml
@@ -9,21 +9,24 @@
 # Reports pass/fail status back to Gitea, so it shows up as a required check on
 # the PR.
 
-# Doc-only changes can't affect the image, so they don't trigger the build.
+# Changes that can't affect the image don't trigger the build: docs and the
+# RouterOS-side script (routeros/**: lives on the router, not in the image).
 # NOTE: if Gitea is ever configured to REQUIRE this check for merging, a
-# doc-only PR will have no check at all — exempt such PRs or merge manually.
-# Renovate PRs always touch the Dockerfile or pipeline files, so the
-# automerge gate is unaffected by these exclusions.
+# PR touching only excluded files will have no check at all — exempt such PRs
+# or merge manually. Renovate PRs always touch the Dockerfile or pipeline
+# files, so the automerge gate is unaffected by these exclusions.
 when:
   - event: pull_request
     path:
-      exclude: &doc_paths
+      exclude: &non_image_paths
         - '**/*.md'
         - 'docs/**'
+        - 'routeros/**'
+        - 'renovate.json'
   - event: push
     branch: main
     path:
-      exclude: *doc_paths
+      exclude: *non_image_paths
 
 steps:
   - name: Build all arches (no push)
diff --git a/.woodpecker/release-tag.yaml b/.woodpecker/release-tag.yaml
index aa50efc..6020512 100644
--- a/.woodpecker/release-tag.yaml
+++ b/.woodpecker/release-tag.yaml
@@ -13,9 +13,10 @@
 # unchanged, so no tag is created and nothing is released — they ride along
 # with the next Tailscale bump or manual tag.
 
-# Skipped for doc-only pushes: TAILSCALE_VERSION lives in the Dockerfile, so a
-# push that doesn't touch non-doc files can never introduce a new version to
-# tag (the job would just no-op after spinning up OpenBao + git containers).
+# Skipped for pushes that can't introduce a new Tailscale version:
+# TAILSCALE_VERSION lives in the Dockerfile, so a push touching only docs or
+# the RouterOS-side script can never produce a new version to tag (the job
+# would just no-op after spinning up OpenBao + git containers).
 when:
   - event: push
     branch: main
@@ -23,6 +24,8 @@ when:
       exclude:
         - '**/*.md'
         - 'docs/**'
+        - 'routeros/**'
+        - 'renovate.json'
 
 steps:
   - name: Get git token from OpenBao