diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c8cd5db..3e89e9d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,7 +1,10 @@
 name: CI
 
+# An unfiltered `push` matches tags too, so a release tag would re-run this against a commit
+# already tested on main. `**` and not `*`, which does not match a branch name with a slash.
 on:
   push:
+    tags-ignore: ['**']
   pull_request:
 
 permissions:
diff --git a/.github/workflows/test-e2e.yml b/.github/workflows/test-e2e.yml
index 4709541..919db53 100644
--- a/.github/workflows/test-e2e.yml
+++ b/.github/workflows/test-e2e.yml
@@ -1,7 +1,10 @@
 name: E2E Tests
 
+# Tags excluded for the reason given in ci.yml -- the Kind suite is the expensive one to
+# re-run for nothing.
 on:
   push:
+    tags-ignore: ['**']
   pull_request:
 
 jobs: